CloudWatch 日誌項目範例 - AWS Transfer Family
轉移工作階段日誌項目範例SFTP 連接器的範例日誌項目金鑰交換演算法失敗的範例日誌項目

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

CloudWatch 日誌項目範例

本主題提供範例日誌項目。

轉移工作階段日誌項目範例

在此範例中，SFTP 使用者連線至 Transfer Family 伺服器、上傳檔案，然後中斷與工作階段的連線。

下列日誌項目反映連線至 Transfer Family 伺服器的 SFTP 使用者。

{
   "role": "arn:aws:iam::500655546075:role/transfer-s3",
   "activity-type": "CONNECTED",
   "ciphers": "chacha20-poly1305@openssh.com,chacha20-poly1305@openssh.com",
   "client": "SSH-2.0-OpenSSH_7.4",
   "source-ip": "52.94.133.133",
   "resource-arn": "arn:aws:transfer:us-east-1:500655546075:server/s-3fe215d89f074ed2a",
   "home-dir": "/test/log-me",
   "ssh-public-key": "AAAAC3NzaC1lZDI1NTE5AAAAIA9OY0qV6XYVHaaOiWAcj2spDJVbgjrqDPY4pxd6GnHl",
   "ssh-public-key-fingerprint": "SHA256:BY3gNMHwTfjd4n2VuT4pTyLOk82zWZj4KEYEu7y4r/0",
   "ssh-public-key-type": "ssh-ed25519",
   "user": "log-me",
   "kex": "ecdh-sha2-nistp256",
   "session-id": "9ca9a0e1cec6ad9d"
}

下列日誌項目反映 SFTP 使用者將檔案上傳至其 Amazon S3 儲存貯體。

{
   "mode": "CREATE|TRUNCATE|WRITE",
   "path": "/test/log-me/config-file",
   "activity-type": "OPEN",
   "resource-arn": "arn:aws:transfer:us-east-1:500655546075:server/s-3fe215d89f074ed2a",
   "session-id": "9ca9a0e1cec6ad9d"
}

下列日誌項目反映 SFTP 使用者中斷與其 SFTP 工作階段的連線。首先，用戶端會關閉與儲存貯體的連線，然後用戶端會中斷 SFTP 工作階段的連線。

{
   "path": "/test/log-me/config-file",
   "activity-type": "CLOSE",
   "resource-arn": "arn:aws:transfer:us-east-1:500655546075:server/s-3fe215d89f074ed2a",
   "bytes-in": "121",
   "session-id": "9ca9a0e1cec6ad9d"
}

{
   "activity-type": "DISCONNECTED",
   "resource-arn": "arn:aws:transfer:us-east-1:500655546075:server/s-3fe215d89f074ed2a",
   "session-id": "9ca9a0e1cec6ad9d"
}
注意

可用的活動類型如下：AUTH_FAILURE、CONNECTED、DISCONNECTED、ERROREXIT_REASON、CLOSE、CREATE_SYMLINK、DELETE、MKDIR、OPEN、PARTIAL_CLOSE、RENAME、RMDIR、、、SETSTAT、、TLS_RESUME_FAILURE、。

SFTP 連接器的範例日誌項目

本節包含成功和失敗傳輸的範例日誌。日誌會產生到名為 的日誌群組/aws/transfer/connector-id，其中 connector-id 是 SFTP 連接器的識別符。當您執行 StartFileTransfer或 StartDirectoryListing命令時，會產生 SFTP 連接器的日誌項目。

此日誌項目適用於成功完成的傳輸。

{
    "operation": "RETRIEVE",
    "timestamp": "2023-10-25T16:33:27.373720Z",
    "connector-id": "connector-id",
    "transfer-id": "transfer-id",
    "file-transfer-id": "transfer-id/file-transfer-id",
    "url": "sftp://192.0.2.0",
    "file-path": "/remotebucket/remotefilepath",
    "status-code": "COMPLETED",
    "start-time": "2023-10-25T16:33:26.945481Z",
    "end-time": "2023-10-25T16:33:27.159823Z",
    "account-id": "480351544584",
    "connector-arn": "arn:aws:transfer:us-east-1:account-id:connector/connector-id",
    "local-directory-path": "/connectors-localbucket"
    "bytes": 514
}

此日誌項目適用於逾時的傳輸，因此無法成功完成。

{
    "operation": "RETRIEVE",
    "timestamp": "2023-10-25T22:33:47.625703Z",
    "connector-id": "connector-id",
    "transfer-id": "transfer-id",
    "file-transfer-id": "transfer-id/file-transfer-id",
    "url": "sftp://192.0.2.0",
    "file-path": "/remotebucket/remotefilepath",
    "status-code": "FAILED",
    "failure-code": "TIMEOUT_ERROR",
    "failure-message": "Transfer request timeout.",
    "account-id": "480351544584",
    "connector-arn": "arn:aws:transfer:us-east-1:account-id:connector/connector-id",
    "local-directory-path": "/connectors-localbucket"
}

此日誌項目適用於成功的 SEND 操作。

{
    "operation": "SEND",
    "timestamp": "2024-04-24T18:16:12.513207284Z",
    "connector-id": "connector-id",
    "transfer-id": "transfer-id",
    "file-transfer-id": "transfer-id/file-transfer-id",
    "url": "sftp://server-id.server.transfer.us-east-1.amazonaws.com",
    "file-path": "/amzn-s3-demo-bucket/my-test-folder/connector-metrics-us-east-1-2024-01-02.csv",
    "status-code": "COMPLETED",
    "start-time": "2024-04-24T18:16:12.295235884Z",
    "end-time": "2024-04-24T18:16:12.461840732Z",
    "account-id": "255443218509",
    "connector-arn": "arn:aws:transfer:us-east-1:account-id:connector/connector-id",
    "bytes": 275
}

先前日誌範例中某些索引鍵欄位的描述。

  • timestamp 代表日誌新增至 CloudWatch 的時間。 start-time和 end-time對應至連接器實際啟動和完成傳輸的時間。

  • transfer-id 是為每個start-file-transfer請求指派的唯一識別符。如果使用者在單一 start-file-transfer API 操作中傳遞多個檔案路徑，則所有檔案都會共用相同的 transfer-id。

  • file-transfer-id 是針對每個傳輸的檔案產生的唯一值。請注意， 的初始部分file-transfer-id與 相同transfer-id。

金鑰交換演算法失敗的範例日誌項目

本節包含金鑰交換演算法 (KEX) 失敗的範例日誌。這些是結構化日誌之 ERRORS 日誌串流中的範例。

此日誌項目是發生主機金鑰類型錯誤的範例。

{
    "activity-type": "KEX_FAILURE",
    "source-ip": "999.999.999.999",
    "resource-arn": "arn:aws:transfer:us-east-1:999999999999:server/s-999999999999999999",
    "message": "no matching host key type found",
    "kex": "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss"
}

此日誌項目是 KEX 不相符的範例。

{
    "activity-type": "KEX_FAILURE",
    "source-ip": "999.999.999.999",
    "resource-arn": "arn:aws:transfer:us-east-1:999999999999:server/s-999999999999999999",
    "message": "no matching key exchange method found",
    "kex": "diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256"
}