CCE日志审计中心

CCE日志审计中心仪表盘主要展示总审计记录数、操作用户数、活跃节点数、异常访问次数等。

分析网站访问情况

1. 登录云日志服务控制台。
2. 在左侧导航栏中选择“仪表盘 ”。
3. 在仪表盘模板下方，选择“CCE日志审计中心”仪表盘，查看图表详情。

CCE日志审计中心仪表盘中的过滤器说明如下所示：

• 命名空间，所关联的查询分析语句如下所示：

  select distinct("objectRef.namespace")

• 操作用户，所关联的查询分析语句如下所示：

  select distinct("user.username")

• 操作类型，所关联的查询分析语句如下所示：

  select distinct("verb")

• 状态码，所关联的查询分析语句如下所示：

  select distinct("responseStatus.code")

• 资源对象，所关联的查询分析语句如下所示：

  select distinct("objectRef.name")

• 资源类型，所关联的查询分析语句如下所示：

  select distinct("objectRef.resource")

• 请求URL，所关联的查询分析语句如下所示：

  select distinct("requestURI")

• UserAgent，所关联的查询分析语句如下所示：

  select distinct("userAgent")

重要图表说明

CCE日志审计中心仪表盘中重要图表说明如下所示：

• 总审计记录数，所关联的查询分析语句如下所示：

  select diff[1] as "total" , round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc" from (select compare( total , 86400) as diff from( select count(1) as total from log ) )

• 操作用户数，所关联的查询分析语句如下所示：

  select diff[1] as "total" , round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc"  from (select compare( total , 86400) as diff from( select count(distinct("user.username")) as total from log ) )

• 活跃节点数，所关联的查询分析语句如下所示：

  select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc" from (select compare( total , 86400) as diff from( select count(DISTINCT "user.username") as total     from log where "objectRef.resource" = 'nodes' and "objectRef.subresource" = 'status' and "verb" in ('update','put','patch') and "user.username" in ('node','system')) )

• 异常访问次数，所关联的查询分析语句如下所示：

  select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc" from (select compare( total , 86400) as diff from( select count(1) as total from log where "responseStatus.code" >= 400) )

• 敏感操作次数，所关联的查询分析语句如下所示：

  select diff[1] as "total" , round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc" from (select compare( total , 86400) as diff from( select count(1)  as "total" from log where ("verb" = 'create' AND "objectRef.subresource" = 'exec') OR ("verb" = 'create' AND "objectRef.subresource" = 'attach' AND "objectRef.resource" = 'pods') OR ("objectRef.resource" = 'secrets' AND "verb"= 'get' AND ( "user.username" != 'apiserver') AND ("user.username" not like 'system:node:%')) OR ("verb"= 'delete' AND ( "user.username" not like 'system:node:%') AND ( "user.username" not like 'system:serviceaccount:kube-system:%') AND ( "user.username" != 'system:apiserve') AND ( "user.username" != 'system:apiserve') AND ( "user.username" != 'system:kube-scheduler') AND ("user.username" != 'system:kube-controller-manager'))) )

• 创建操作次数，所关联的查询分析语句如下所示：

  select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc" from (select compare( total , 86400) as diff from( select count(1) as total from log where verb = 'create') )

• 更新操作次数，所关联的查询分析语句如下所示：

  select diff[1] as "total" , round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc"  from (select compare( total , 86400) as diff from( select count(1) as total from log where verb in ('update','patch')) )

• 删除操作次数，所关联的查询分析语句如下所示：

  select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100 , 2 ) as "inc" from (select compare( total , 86400) as diff from( select count(1) as total from log where verb = 'delete') )

• 操作用户分布，所关联的查询分析语句如下所示：

  select "user.username" as "用户名", count(*) as "count"  group by "用户名" order by "count" desc

• 命名空间分布，所关联的查询分析语句如下所示：

  select "objectRef.namespace" as "命名空间", count(*) as "count"  group by "命名空间"

• 资源类型分布，所关联的查询分析语句如下所示：

  select "objectRef.resource" as "资源类型", count(*) as "count"  group by "资源类型" order by "count" desc limit 20

• 操作类型分布，所关联的查询分析语句如下所示：

  select verb as "操作类型", count(*) as "count" group by "操作类型" order by "count" desc

• 节点操作分布，所关联的查询分析语句如下所示：

  select "verb" as "操作类型", count(*) as "count" where  "objectRef.resource" = 'nodes' AND ("verb" in ('create','delete') ) group by "操作类型" order by "count" desc

• 状态码分布，所关联的查询分析语句如下所示：

  select cast("responseStatus.code" as varchar) as "状态码", count(*) as "count" group by "状态码" order by "count" desc

• 工作负载操作分布，所关联的查询分析语句如下所示：

  select "verb" as "操作类型", count(*) as "count" where "verb" in ('create', 'delete') and "objectRef.resource" in ('deployments','statefulsets','daemonsets','jobs','cronjobs') group by "操作类型" order by "count" desc

• Service/Ingress操作分布，所关联的查询分析语句如下所示：

  select "verb" as "操作类型", count(*) as "count" where "verb" in ('create', 'delete') and "objectRef.resource" in ('ingressess','services') group by "verb"  order by "count" desc

• 重要操作趋势，所关联的查询分析语句如下所示：

  SELECT REPLACE(LEFT("stageTimestamp", 16),'T',' ') AS "dt", "verb", count(*) as "count" where "verb" in ('create','delete','update','patch') group by "dt", "verb" order by "dt" limit 10000

• 非系统用户操作趋势，所关联的查询分析语句如下所示：

  SELECT REPLACE(LEFT("stageTimestamp", 16),'T',' ') AS "dt", count(*) as "count", "user.username" as "用户名称" where "user.username" not in ('kube-controller-manager','kube-apiserver-kubelet-client','system','apiserver') group by "dt", "用户名称" order by "dt" limit 10000