Viewing Traces

Scenarios

Cloud Trace Service (CTS) records operations performed on cloud service resources. A record contains information such as the user who performed the operation, IP address, operation content, and returned response message. These operation records let you do security audit, trace issues, and locate resources quickly. They also help you plan and use resources, and identify high-risk or non-compliant operations.

What Is a Trace?

A trace is an operation log for a cloud service resource, tracked and stored by CTS. Traces record operations such as adding, modifying, or deleting cloud service resources. You can view traces to identify when operations were performed by which users for tracking.

What Is a Management Tracker and Data Tracker?

A management tracker identifies and associates with all your cloud services, recording all user operations. It records management traces, which are operations performed by users on cloud service resources, such as their creation, modification, and deletion.

A data tracker records details of user operations on data in OBS buckets. It records data traces reported by OBS, detailing user operations on data in OBS buckets, including uploads and downloads.

Notes and Constraints

Before the Organizations service is enabled, you can query the traces of a single account on the CTS console. After the Organizations service is enabled, you can view multi-account traces on the Trace List page of each account, or in the OBS bucket or the CTS/system log stream configured for the management tracker with Organizations enabled. For details about organization trackers, see Organization Tracker Overview.
Users can only query operation records of the last seven days on the CTS console. Expired records will be automatically deleted but cannot be manually deleted. To query operation records of more than seven days, you must configure an OBS bucket or LTS log group to transfer records to it, and then you can view historical records in the bucket or log group. Otherwise, you cannot query the operation records generated seven days ago.
After creating, modifying, or deleting a cloud service resource, users can query management traces on the CTS console within 1 minute and query data traces 5 minutes later.
Data traces are not displayed in the trace list of the new CTS version. To view them, you need to go to the old version.

Prerequisites

Sign up for a HUAWEI ID and complete real-name authentication.

If you already have one, skip this step. If you do not have one, do as follows:
1. Log in to the Huawei Cloud official website, and click Sign Up in the upper right corner.
2. Complete the signup as prompted. For details, see Logging In to the Management Console.
  After the signup, you will be redirected to your personal information page.
3. Complete individual or enterprise real-name authentication. For details, see Real-Name Authentication.
Grant permissions.

If you log in to the console using an account, skip this step.

If you log in to the console as an IAM user, first contact your CTS administrator (account owner or a user in the admin user group) to obtain the CTS FullAccess permission. For details, see Assigning Permissions to an IAM User.

Procedure

After you enable CTS and the management tracker is created, CTS starts recording operations on cloud resources. After a data tracker is created, CTS starts recording user operations on data in OBS buckets. CTS retains operation records of the latest seven days.

This section describes how to query and export operation records of the last seven days on the CTS console.

Viewing Traces in the Trace List of the New CTS Edition

Log in to the CTS console.
In the navigation pane, choose Trace List.
In the time range drop-down list above the trace list, select a desired query time range: Last 1 hour, Last 1 day, or Last 1 week. You can also select Custom to specify a custom time range within the last seven days.

On the Trace List page, use advanced search to query traces. You can combine one or more filters.

**Table 1** Trace filtering parameters
Parameter	Description
Trace Name	Name of a trace. The value is case sensitive and requires an exact match. Fuzzy match is not supported. For the operation events that can be audited in each cloud service, see Supported Services and Operations. Example: updateAlarm
Cloud Service	Cloud service name abbreviation. The value is case sensitive and requires an exact match. Fuzzy match is not supported. Example: IAM
Resource Name	Name of a cloud resource involved in a trace. The value is case sensitive and requires an exact match. Fuzzy match is not supported. If the cloud resource involved in the trace does not have a resource name or the corresponding API operation does not involve the resource name parameter, leave this field empty. Example: ecs-name
Resource ID	ID of a cloud resource involved in a trace. The value is case sensitive and requires an exact match. Fuzzy match is not supported. Leave this field empty if the resource has no resource ID or the resource fails to be created. Example: {VM-ID}
Trace ID	Value of the trace_id parameter for a trace reported to CTS. The value requires an exact match. Fuzzy match is not supported. Example: 01d18a1b-56ee-11f0-ac81-**1e229
Resource Type	Type of a resource involved in a trace. The value is case sensitive and requires an exact match. Fuzzy match is not supported. For the resource types that can be audited in each cloud service, see Supported Services and Operations. Example: user
Operator	User who triggers a trace. Select one or more operators from the drop-down list. If the value of trace_type in a trace is SystemAction, the operation is triggered by the service and the trace's operator may be empty. For details about the relationship between IAM identities and operators and the operator username format, see Relationship Between IAM Identities and Operators.
Trace Status	Select one of the following options from the drop-down list: normal: The operation succeeded. warning: The operation failed. incident: The operation caused a fault that is more serious than a normal failure, for example, causing other faults.
Enterprise Project ID	ID of the enterprise project to which a resource belongs. To check enterprise project IDs, go to the Enterprise Project Management Service (EPS) console and choose Project Management in the navigation pane. Example: b305ea24-c930-4922-b4b9-**1eb2
Access Key ID	Temporary or permanent access key ID. To check access key IDs, hover over your username in the upper right corner of the console and select My Credentials from the pop-up list. On the displayed page, choose Access Keys in the navigation pane. Example: HSTAB47V9V***TLN9

On the Trace List page, export operation records, refresh the trace list, and specify columns to display.
- Enter any keyword in the search box and press Enter to filter traces.
- Click Export to export all traces in the query result as an XLSX file. The file can contain up to 5,000 records.
- Click to view the latest information about traces.
- Click to customize the information to be displayed in the trace list. If Auto wrapping is enabled (), excess text will move down to the next line; otherwise, the text will be truncated. By default, this function is disabled.
(Optional) On the Trace List page of the new edition, click Old Edition in the upper right corner to switch to the Trace List page of the old edition.

Viewing Traces in the Trace List of the Old CTS Edition

Log in to the CTS console.
In the navigation pane, choose Trace List.
Each time you log in to the CTS console, the new edition is displayed by default. Click Old Edition in the upper right corner to switch to the trace list of the old edition.
In the upper right corner of the page, select a desired query time range: Last 1 hour, Last 1 day, or Last 1 week. You can also select Custom to specify a custom time range within the last seven days.

Set filters to search for desired traces.

**Table 2** Trace filtering parameters
Parameter	Description
Trace Type	Select Management or Data. Management traces record operations performed by users on cloud service resources, including creation, modification, and deletion. Data traces are reported by OBS and record operations performed on data in OBS buckets, including uploads and downloads.
Cloud Service	Select the name of the cloud service that triggers a trace from the drop-down list.
Resource Type	Select the type of the resource involved in a trace from the drop-down list. For the resource types that can be audited in each cloud service, see Supported Services and Operations.
Operator	User who triggers a trace. Select one or more operators from the drop-down list. If the value of trace_type in a trace is SystemAction, the operation is triggered by the service and the trace's operator may be empty. For details about the relationship between IAM identities and operators and the operator username format, see Relationship Between IAM Identities and Operators.
Trace Status	Select one of the following options: Normal: The operation succeeded. Warning: The operation failed. Incident: The operation caused a fault that is more serious than a normal failure, for example, causing other faults.

Click Query.
On the Trace List page, you can also export and refresh the trace list.
- Click Export to export all traces in the query result as a CSV file. The file can contain up to 5,000 records.
- Click to view the latest information about traces.
In the Tampered column of a trace, check whether the trace is tampered with.
- No: The trace is not tampered with.
- Yes: The trace is tampered with.
Click on the left of a trace to expand its details.
Click View Trace in the Operation column. The trace details are displayed.
(Optional) On the Trace List page of the old edition, click New Edition in the upper right corner to switch to the Trace List page of the new edition.