DCS Dashboard Template

Prerequisites

Logs have been structured. For details, see Setting Cloud Structuring Parsing.

DCS Audit Log Center

1. Log in to the LTS console. In the navigation pane, choose Dashboards.
2. Choose DCS dashboard templates under Dashboard Templates and click DCS audit log center to view the chart details.
   • Users. The associated query and analysis statement is:

     select count(distinct(user)) as user_num
   • Clients. The associated query and analysis statement is:

     select count(distinct(client_addr)) as client_num
   • Audit Logs. The associated query and analysis statement is:

     select count(1) as log_num
   • Average Response Time. The associated query and analysis statement is:

     select avg(use_time) as avg_time
   • Average QPS. The associated query and analysis statement is:

     select count(*) / CAST((TIMESTAMPDIFF (minute, MIN(__time),MAX(__time))+1) as FLOAT)
   • Top 5 Users. The associated query and analysis statement is:

     select user, count(1) as 'user_count' group by user order by count(1) desc LIMIT 5
   • Top 5 Clients. The associated query and analysis statement is:

     select client_addr, count(1) as 'remote_count' group by client_addr order by count(1) desc limit 5
   • Top 5 Commands. The associated query and analysis statement is:

     select command_name, count(1) as 'command_count' group by command_name order by count(1) desc
   • Hot Keys. The associated query and analysis statement is:

     SELECT count(*) as 'count',  command_keys GROUP by command_keys order by count(*) desc limit 5
   • Audit Log Details. The associated query and analysis statement is:

     select  "client_addr" as 'Client IP Address',"client_type" as 'Client Type',"server_addr" as 'Server IP Address',"command_name" as 'Command',"command_keys" as 'Keys',"command_param" as 'Command Content',"command_type" as 'Command Type',"use_time" as 'Execution Duration',"time" as 'Executed',"db" as 'DB',"user" as 'Username',"instance_id" as 'Instance ID',"role" as 'Node Role',"extend" as 'Extended Information'