This topic describes the fields in the Layer 7 access logs of Classic Load Balancer (CLB), Cloud Config logs, and CloudMonitor events.
Access logs
| Field | Description |
|---|---|
| __topic__ | The topic of the log. The value is fixed as slb_layer7_access_log. |
| body_bytes_sent | The number of bytes in the body of the HTTP response that is sent to the client. |
| client_ip | The IP address of a client. |
| host | The host. By default, the value is obtained from request parameters. If no value is obtained from request parameters, the value is obtained from the Host header. If no value is obtained from request parameters or the Host header, the IP address of the backend server that processes the request is used as the value. |
| http_host | The Host header of the HTTP request. |
| http_referer | The Referer header of the HTTP request that is received by the proxy. |
| http_user_agent | The User-Agent header of the HTTP request that is received by the proxy. |
| http_x_forwarded_for | The X-Forwarded-For (XFF) header of the HTTP request that is received by the proxy. |
| http_x_real_ip | The originating IP address of the client. |
| read_request_time | The time that is taken by the proxy to read the request. Unit: milliseconds. |
| request_length | The length of the request. The request line, request headers, and request body are all counted. |
| request_method | The request method. |
| request_time | The interval between the time when the proxy receives the first request and the time when the proxy returns a response. Unit: seconds. |
| request_uri | The URI of the request that is received by the proxy. |
| scheme | The schema of the request. Valid values: HTTP and HTTPS. |
| server_protocol | The HTTP version of the request that is received by the proxy. Examples: HTTP/1.0 and HTTP/1.1. |
| slb_vport | The listening port of the CLB instance. |
| slbid | The ID of the CLB instance. |
| ssl_cipher | The cipher suite that is used to establish an SSL connection. Example: ECDHE-RSA-AES128-GCM-SHA256. |
| ssl_protocol | The protocol that is used to establish an SSL connection. Example: TLSv1.2. |
| status | The HTTP status code that is sent by the proxy. |
| tcpinfo_rtt | The round-trip time (RTT) of the TCP connection that is established by the client. Unit: microseconds. |
| time | The time when the log is generated. |
| upstream_addr | The IP address and port number of the backend server. |
| upstream_response_time | The interval between the time when the CLB instance connects to the backend server and the time when the CLB instance disconnects from the backend server after the required data is received. Unit: seconds. |
| upstream_status | The HTTP status code that is received by the proxy from the backend server. |
| vip_addr | The virtual IP address. |
| write_response_time | The time that is taken by the CLB proxy to send the request to the client after the CLB proxy receives the request from the backend server. Unit: milliseconds. |
Cloud Config logs
- Configuration change records
Field Description accountId The ID of the Alibaba Cloud account to which the resource belongs. arn The Alibaba Cloud Resource Name (ARN) of the RAM role. availabilityZone The ID of the zone where the resource resides. captureTime The timestamp when the resource compliance evaluation is recorded. Unit: milliseconds. configuration The rules that are associated with the resource and the compliance details of the rules. configurationDiff The details of the resource changes that trigger the compliance evaluation. dataType The type of the event. The value is fixed as ConfigurationItemChangeNotification. regionId The ID of the region. relationship The details of the resource whose changes trigger the compliance evaluation. The details include the region ID, resource relationship, resource ID, and resource type. relationshipDiff The details of the resource changes that trigger the compliance evaluation. requestId The ID of the request. resourceCreateTime The timestamp when the resource is created. Unit: milliseconds. resourceEventType The resource event. resourceGroupId The ID of the resource group. resourceId The ID of the resource. realResourceId The ID of the level-1 resource. resourceName The name of the resource. resourceStatus The status of the resource. resourceType The type of the resource. serviceName The name of the service. tags The tags of the resource. version The version number. - Resource non-compliance events
Field Description accountId The ID of the Alibaba Cloud account to which the resource belongs. annotation The description of the resource non-compliance event. riskLevel The risk level of the event. Valid values: 1: high 2: medium 3: low. dataType The type of the data. The value is fixed as NonCompliantNotification, which indicates the data of a non-compliance event. evaluationResultIdentifier The identifier of the resource evaluation result. eventType The type of the event. invokingEventMessageType The trigger type of the rule. complianceType The compliance evaluation result of the rule. Valid values: COMPLIANT: The resource is compliant. NON_COMPLIANT: The resource is non-compliant. NOT_APPLICABLE: The rule does not apply to your resource. INSUFFICIENT_DATA: No resource data is available. requestId The ID of the request. eventName The name of the event. notificationCreationTime The timestamp when the notification is created. regionId The ID of the region. resourceId The ID of the resource. resourceType The type of the resource. serviceName The name of the service.
CloudMonitor events
| Field | Description |
|---|---|
| event_id | The ID of the CloudMonitor event. |
| source | The source of the event. The value includes information such as the type of the event source, the publishing mechanism of the event, or the process of producing the event. |
| version | The version of the CloudEvents specification. |
| publish_time | The time at which the event is pushed. |
| type | The type of the event, which is related to the event source. |
| data | The content of the event. The value is a JSON object. The content of the object varies based on the event source that produces the event. |
| data_type | The value is fixed and indicates a CloudMonitor event. |
| region | The region where the event occurs. |
| account_id | The ID of the Alibaba Cloud account to which the event belongs. |