Transferring CTS Traces to OBS and Viewing Them

Constraints

For global services, you must configure trackers on the CTS console in the central region (CN-Hong Kong). This configuration enables the function of transferring traces to OBS. The preceding function will not take effect if you perform the configuration on the CTS console in any region outside the central region.

For details about Huawei Cloud global services, see Constraints.

Preparations

1. Register with Huawei Cloud and complete real-name authentication.

   If you already have one, skip this step. If you do not have one, do as follows:

   1. Log in to the Huawei Cloud official website, and click Register in the upper right corner.
   2. Complete the registration as prompted. For details, see Registering with Huawei Cloud.

      Your personal information page is displayed after the registration completes.

   3. Complete individual or enterprise real-name authentication by referring to Real-Name Authentication.
2. Top up your account.

   Transferring traces to OBS will incur fees. Ensure that your account balance is sufficient.

   • For details about OBS pricing, see Object Storage Service Pricing Details.
   • For details about how to top up an account, see Topping Up an Account.
3. Grant permissions for users.

   If you log in to the console using a Huawei Cloud account, skip this step.

   If you log in to the console as an Identity and Access Management (IAM) user, first contact your CTS administrator (account owner or a user in the admin user group) to obtain the CTS FullAccess permissions. For details, see Assigning Permissions to an IAM User.

Configuring Trace Transfer to OBS

1. Log in to the CTS console.
2. Select a region closest to your application to reduce latency and accelerate access.

   In this example, select CN North-Beijing4.

3. In the navigation pane, choose Tracker List.
4. Click Configure in the Operation column of the system tracker.
   Figure 1 Configuring the system tracker
   

5. On the Basic Information page, set parameters as follows and click Next.
   Figure 2 Setting basic information
   

   Table 1 Setting basic information

   Parameter	Description	Example in This Case
   Tracker Name	The name of a management tracker is system by default and cannot be changed.	system
   Enterprise Project	Enterprise projects allow you to manage cloud resources and users by project. For details about how to enable them, see Creating an Enterprise Project. If you have not enabled the enterprise project management service, skip this parameter. If you have enabled the service, select default in this case.	default
   Apply to Organization	CTS supports the multi-account management capability of Organizations. After you enable Apply to Organization, the following functions are available. For details, see Organization Trackers. Use an organization administrator account to set CTS as a trusted service on the Organizations console and specify a delegated administrator account. You can use the delegated administrator account to configure an organization tracker in CTS. Then the delegated administrator account can implement cloud audit capabilities, such as security audit.	Disable
   Operation	If you select Exclude KMS traces, the tracker will not transfer the data about operations on Data Encryption Workshop (DEW). For details about DEW audit operations, see Operations supported by CTS.	Deselect

6. On the Configure Transfer page, set parameters as follows and click Next > Configure. After the tracker is configured, the system starts recording operations based on the new rule.
   Figure 3 Configuring transfer parameters
   

   Table 2 Setting basic information

   Parameter	Description	Example in This Case
   Transfer to OBS	CTS records details about operations performed by tenants, such as creating, modifying, and deleting cloud service resources, and retains these records as traces for seven days. To store traces for more than seven days, configure trace transfer to OBS. This allows CTS to periodically transfer trace files to OBS buckets for long-term storage. After Transfer to OBS is enabled, trace files will be periodically transferred to OBS buckets.	Enable
   Create a cloud service agency.	After enabling Transfer to OBS, you must select Create a cloud service agency. CTS will automatically create a cloud service agency named cts_admin_trust to authorize you to use OBS.	Select
   OBS Bucket Account	You can transfer traces to OBS buckets of the logged-in user or other users for unified management. If you select Logged-in user, you do not need to grant the transfer permission. If you select Other users, ensure that the OBS bucket owner has granted you the transfer permission. Otherwise, the transfer will fail. For details about how to grant the transfer permission, see Cross-Tenant Transfer Authorization.	Logged-in user
   OBS Bucket	You can create an OBS bucket or select an existing OBS bucket. If you select a region different from the region of the logged-in user, you can only select an existing OBS bucket. New: An OBS bucket will be created automatically with the name you enter. Existing: Select an existing OBS bucket.	New
   Select Bucket	The OBS bucket name cannot be empty. It can contain 3 to 63 characters, including only lowercase letters, digits, hyphens (-), and periods (.). It cannot contain two consecutive periods (for example, my..bucket). A period (.) and a hyphen (-) cannot be adjacent to each other (for example, my-.bucket and my.-bucket). Do not use an IP address as a bucket name.	system-bucket-01
   Retention Period	Different compliance standards require different trace retention periods. When you configure a management tracker, Same as OBS is selected for Retention Period by default and cannot be modified.	Same as OBS
   File Prefix	A file prefix is used to mark transferred trace files. The prefix you set will be automatically added to the beginning of the file names, facilitating file filtering. Enter 0 to 64 characters. Only letters, digits, underscores (_), hyphens (-), and periods (.) are allowed. A trace file name is in the following format: Trace file prefix_CloudTrace_Region/Region-Project_Time when the trace file was uploaded to OBS: Year-Month-DayTHour-Minute-SecondZ_Random characters.json.gz Example: File prefix_CloudTrace_region-project_2016-05-30T16-20-56Z_21d36ced8c8af71e.json.gz	FilePrefix
   Verify Trace File	To enable this function, toggle on Verify Trace File. Then CTS will generate a digest file for hash values of all trace files recorded in the past hour and synchronize the digest file to the Object Storage Service (OBS) bucket configured for the current tracker. You can implement your own verification solution with these files. For details about integrity verification, see Verifying Trace File Integrity. For more information about digest files, see Digest Files.	Disable
   Encrypt Trace File	CTS supports trace file encryption. Trace files transferred to OBS buckets can be encrypted using keys provided by DEW. If you selected Logged-in user for OBS Bucket Account and enabled Encrypt Trace File, CTS obtains the key IDs of the logged-in user from DEW and displays them in the drop-down list for you to select.	Disable

Viewing Historical Traces in an OBS Bucket

After you configure the system tracker to transfer traces to an OBS bucket, the system will record operations based on the new rule and transfer historical trace files to the bucket for you to download and view.

1. On the Tracker List page, the OBS bucket system-bucket-01 that you set when configuring the transfer is displayed in the Storage column of the system tracker. Click the bucket name to go to the bucket's management page on the OBS console.
   Figure 4 Clicking the OBS bucket name
   

2. In the navigation pane, click Objects.
3. On the Objects tab page, open the folders in sequence based on the trace file storage path.
   In this case, click CloudTraces > cn-north-4 > 2024 > Month > Day > system > OBS. Month and Day indicate the date when you create the OBS bucket system-bucket-01.

   NOTE:

   Format of the trace file path: OBS bucket name > CloudTraces > Region > Year > Month > Day > Tracker name > Service directory

   Figure 5 Trace file storage path
   

4. In this case, find the file with the earliest last modification time and click Download on the right to download it to the default download path of the browser. To save it to a custom path, click More > Download As on the right.
   NOTE:

   • Trace file name format: Trace file prefix_CloudTrace_Region/Region-Project_Time when the trace file was uploaded to OBS: Year-Month-DayTHour-Minute-SecondZ_Random characters.json.gz

     Example: File prefix_CloudTrace_cn-north-4_2024-08-13T07-23-42Z_eaac2d5c641fe022.json.gz

   • The OBS bucket name and trace file prefix are set by you and other parameters are automatically generated.
   • File download will incur request fees and traffic fees.

5. Decompress the downloaded package to obtain a JSON file with the same name as the package. Open the JSON file using a text file editor to view historical traces.
   For details about key fields in a trace, see Trace Structure and Example Traces.

   Figure 6 JSON file