- What's New
- Function Overview
- Service Overview
- Getting Started
- User Guide
- Best Practices
- API Reference
- SDK Reference
-
FAQs
- Must I Use an IAM User (Sub Account) to Configure Transfer on CTS and Perform Operations on an OBS Bucket?
- What Information Is on the Trace List?
- How Will CTS Be Affected If My Account Balance Is Insufficient?
- What Are the Recommended Users of CTS?
- What Will Happen If I Have Enabled Trace Transfer But Have Not Configured an Appropriate Policy for an OBS Bucket?
- Does CTS Support Integrity Verification of Trace Files?
- Why Are There Some Null Fields on the View Trace Page?
- Why Is an Operation Recorded Twice in the Trace List?
- What Services Are Supported by Key Event Notifications?
- How Can I Store Trace Files for a Long Time?
- Why Are user and source_ip Null for Some Traces with trace_type as SystemAction?
- How Do I Find Out Who Created a Specific ECS?
- How Do I Find Out the Login IP Address of an IAM User?
- Why Are Two deleteMetadata Traces Generated When I Buy an ECS in Pay-per-Use or Yearly/Monthly?
- What If I Cannot Query Traces?
- Can I Disable CTS?
- How Do I Make the Log Retention Period 180 Days?
- What Can I Do If a Tracker Cannot Be Created on the CTS Console?
- What Should I Do If I Cannot Enable CTS as an IAM User?
- How Do I Enable Alarm Notifications for EVS?
- Can I Receive Duplicate Traces?
- What Should I Do If I Fail to Transfer Data to an OBS Bucket Authorized by a Key of Another Tenant?
- Does the cts_admin_trust Agency Include OBS Authorization?
- Does CTS Record ECS Creation Failures?
- Glossary
-
More Documents
-
User Guide (ME-Abu Dhabi Region)
- Service Overview
- Getting Started
- Querying Traces
- Management Trackers
- Data Trackers
- Application Examples
- Trace References
- Cross-Tenant Transfer Authorization
- Verifying Trace File Integrity
- Auditing
- Permissions Management
- Supported Services and Operations
-
FAQs
- Must I Use an IAM User (Sub Account) to Configure Transfer on CTS and Perform Operations on an OBS Bucket?
- What Information Is on the Trace List?
- How Will CTS Be Affected If My Account Balance Is Insufficient?
- What Are the Recommended Users of CTS?
- What Will Happen If I Have Enabled Trace Transfer But Have Not Configured an Appropriate Policy for an OBS Bucket?
- Does CTS Support Integrity Verification of Trace Files?
- Why Are There Some Null Fields on the View Trace Page?
- Why Is an Operation Recorded Twice in the Trace List?
- What Services Are Supported by Key Event Notifications?
- How Can I Store Trace Files for a Long Time?
- Why Are user and source_ip Null for Some Traces with trace_type as SystemAction?
- How Do I Find Out Who Created a Specific ECS?
- How Do I Find Out the Login IP Address of an IAM User?
- Why Are Two deleteMetadata Traces Generated When I Buy an ECS?
- What If I Cannot Query Traces?
- Can I Disable CTS?
- How Do I Enable Alarm Notifications for EVS?
- Can I Receive Duplicate Traces?
- Does CTS Record ECS Creation Failures?
- API Reference (ME-Abu Dhabi Region)
-
User Guide (Paris)
- Service Overview
- Getting Started
- Querying Traces
- Management Trackers
- Application Examples
- Trace References
- Cross-Tenant Transfer Authorization
- Verifying Trace File Integrity
- Auditing
- Permissions Management
- Supported Services and Operations
-
FAQs
- Must I Use an IAM User (Sub Account) to Configure Transfer on CTS and Perform Operations on an OBS Bucket?
- How Will CTS Be Affected If My Account Balance Is Insufficient?
- What Are the Recommended Users of CTS?
- What Will Happen If I Have Enabled Trace Transfer But Have Not Configured an Appropriate Policy for an OBS Bucket?
- Does CTS Support Integrity Verification of Trace Files?
- Why Are There Some Null Fields on the View Trace Page?
- Why Is an Operation Recorded Twice in the Trace List?
- What Services Are Supported by Key Event Notifications?
- How Can I Store Trace Files for a Long Time?
- Why Are user and source_ip Null for Some Traces with trace_type as SystemAction?
- How Do I Find Out Who Created a Specific ECS?
- How Do I Find Out the Login IP Address of an IAM User?
- Why Are Two deleteMetadata Traces Generated When I Buy an ECS?
- What If I Cannot Query Traces?
- Can I Disable CTS?
- How Do I Enable Alarm Notifications for EVS?
- Can I Receive Duplicate Traces?
- Does CTS Record ECS Creation Failures?
- API Reference (Paris)
-
User Guide (Kuala Lumpur Region)
- Service Overview
- Getting Started
- Querying Traces
- Management Trackers
- Trackers
- Organization Trackers
- Application Examples
- Trace References
- Cross-Tenant Transfer Authorization
- Verifying Trace File Integrity
- Auditing
- Permissions Management
- Supported Services and Operations
-
FAQs
- Must I Use an IAM User (Sub Account) to Configure Transfer on CTS and Perform Operations on an OBS Bucket?
- What Information Is on the Trace List?
- How Will CTS Be Affected If My Account Balance Is Insufficient?
- What Are the Recommended Users of CTS?
- What Will Happen If I Have Enabled Trace Transfer But Have Not Configured an Appropriate Policy for an OBS Bucket?
- Does CTS Support Integrity Verification of Trace Files?
- Why Are There Some Null Fields on the View Trace Page?
- Why Is an Operation Recorded Twice in the Trace List?
- What Services Are Supported by Key Event Notifications?
- How Can I Store Trace Files for a Long Time?
- Why Are user and source_ip Null for Some Traces with trace_type as SystemAction?
- How Do I Find Out Who Created a Specific ECS?
- How Do I Find Out the Login IP Address of an IAM User?
- Why Are Two deleteMetadata Traces Generated When I Buy an ECS?
- What If I Cannot Query Traces?
- Can I Disable CTS?
- How Do I Enable Alarm Notifications for EVS?
- Can I Receive Duplicate Traces?
- Does CTS Record ECS Creation Failures?
- API Reference (Kuala Lumpur Region)
-
User Guide (ME-Abu Dhabi Region)
- Videos
- General Reference
Copied.
Transferring CTS Traces to LTS and Viewing Them
CTS records details of tenant operations, such as creating, modifying, and deleting cloud service resources, and stores these records as traces in the trace list for seven days. To store traces for more than seven days, configure trace transfer to LTS. This allows CTS to periodically transfer trace files to LTS log streams for long-term storage.
This section describes how to configure the transfer and how to view historical traces in OBS buckets.
- Preparations
Before configuring LTS transfer, ensure that you have registered with Huawei Cloud, completed real-name authentication, topped up your account, and granted the necessary permissions to users.
- Configuring Trace Transfer to LTS
On the management tracker configuration page, enable Transfer to LTS so that trace files will be periodically transferred to an LTS log stream.
- Viewing Historical Traces in an LTS Log Stream
You can view historical operation records in LTS log streams.
Constraints
For global services, you must configure trackers on the CTS console in the central region (CN-Hong Kong). This configuration enables the function of transferring traces to LTS. The preceding function will not take effect if you perform the configuration on the CTS console in any region outside the central region.
For details about Huawei Cloud global services, see Constraints.
Preparations
- Register with Huawei Cloud and complete real-name authentication.
If you already have one, skip this step. If you do not have one, do as follows:
- Log in to the Huawei Cloud official website, and click Register in the upper right corner.
- Complete the registration as prompted. For details, see Registering with Huawei Cloud.
Your personal information page is displayed after the registration completes.
- Complete individual or enterprise real-name authentication by referring to Real-Name Authentication.
- Top up your account.
Transferring logs to LTS will incur fees. Ensure that your account balance is sufficient.
- For details about LTS pricing, see Log Tank Service Pricing Details.
- For details about how to top up an account, see Topping Up an Account.
- Grant permissions for users.
If you log in to the console using a Huawei Cloud account, skip this step.
If you log in to the console as an Identity and Access Management (IAM) user, first contact your CTS administrator (account owner or a user in the admin user group) to obtain the CTS FullAccess permissions. For details, see Assigning Permissions to an IAM User.
- Configure CTS log ingestion on the LTS console.
If you transfer CTS logs to LTS for the first time, perform the following steps to configure CTS log ingestion:
- Log in to the LTS console.
- Choose Log Ingestion in the navigation pane. On the displayed page, click CTS (Cloud Trace Service).
- On the displayed page, retain the default values for Log Group and Log Stream, and click Next: Configure CTS > Next: Configure Log Stream > Submit.
Configuring Trace Transfer to LTS
- Log in to the CTS console.
- Select a region closest to your application to reduce latency and accelerate access.
In this example, select CN North-Beijing4.
- In the navigation pane, choose Tracker List.
- Click Configure in the Operation column of the system tracker.
Figure 1 Configuring the system tracker
- On the Basic Information page, set parameters as follows and click Next.
Figure 2 Setting basic information
Table 1 Setting basic information Parameter
Description
Example in This Case
Tracker Name
The name of a management tracker is system by default and cannot be changed.
system
Enterprise Project
Enterprise projects allow you to manage cloud resources and users by project. For details about how to enable them, see Creating an Enterprise Project.- If you have not enabled the enterprise project management service, skip this parameter.
- If you have enabled the service, select default in this case.
default
Apply to Organization
CTS supports the multi-account management capability of Organizations. After you enable Apply to Organization, the following functions are available. For details, see Organization Trackers.
- Use an organization administrator account to set CTS as a trusted service on the Organizations console and specify a delegated administrator account.
- You can use the delegated administrator account to configure an organization tracker in CTS. Then the delegated administrator account can implement cloud audit capabilities, such as security audit.
Disable
Operation
If you select Exclude KMS traces, the tracker will not transfer the data about operations on Data Encryption Workshop (DEW).
For details about DEW audit operations, see Operations supported by CTS.
Deselect
- On the Configure Transfer page, set parameters as follows and click Next > Configure. After the tracker is configured, the system starts recording operations based on the new rule.
Figure 3 Configuring transfer parameters
Table 2 Setting basic information Parameter
Description
Example in This Case
Transfer to LTS
CTS records details of tenant operations, such as creating, modifying, and deleting cloud service resources, and stores these records as traces in the trace list for seven days. To store traces for more than seven days, configure trace transfer to LTS. This allows CTS to periodically transfer trace files to LTS log streams for long-term storage.
To enable this function, toggle on Transfer to LTS.
Enable
Log Group
The default log group name is CTS and cannot be changed. Traces will be transferred to the CTS/system-trace log stream.
CTS
Viewing Historical Traces in an LTS Log Stream
After you configure the system tracker to transfer traces to an LTS log stream, the system will record operations based on the new rule and transfer historical trace files to the stream for you to view.
- On the Tracker List page, the log stream CTS/system-trace that you set when configuring the transfer is displayed in the Storage column of the system tracker. Click the stream name to go to the stream details page on the LTS console.
Figure 4 Clicking the log stream name
- On the page displayed, view historical logs.
For details about key fields in a trace, see Trace Structure and Example Traces.
Figure 5 system-trace log stream page - Click
to download the log file to your local PC.
NOTE:
Each time you can download up to 5,000 log events. If you select over 5,000 log events, you need to transfer them to OBS and then download them from OBS.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot