Document navigation

ZWatch

The following terminology and concepts are central to your understanding and use of ZWatch:
  1. Metric: a set of time-series data published to ZWatch, such as the VM CPU utilization.
  2. Event: a set of discrete data published to ZWatch, such as host disconnection.
    Note:
    • A metric is a set of time-series data, such as the VM CPU utilization collected at an interval of 10 seconds.
    • An event is a set of discrete data, such as the host disconnection event occurred after network disconnection.
  3. Alarm: a metric alarm that can be triggered under specific condition. For example, if the CPU utilization of a particular VM instance exceeds 80% in 5 consecutive minutes, an alarm can be triggered and alarm messages can be sent to users via email.
  4. Event Subscription: an alarm that is only applicable to events. For example, if the host disconnection event occurs, an event subscription can be sent to users via email.
  5. Text Template: a template for formatting alarm texts when an alarm or event subscription is triggered.

Metric

GetAllMetricMetadata

Obtains system-defined metrics and their metadata. Metrics include system data and custom data. For example,
GetAllMetricMetadata namespace=ZStack/PrimaryStorage

Parameters

Name Description Optional Valid Value Starting Version
name The name of the metric. Yes 3.9.0
namespace The namespace of the metric. Yes 3.9.0
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
Sample response:
[
        {
            "description": "OperatingSystemCPUSystemUtilization",
            "driver": "PrometheusDatabaseDriver",
            "labelNames": [
                "BaremetalVMUuid",
                "CPUNum"
            ],
            "name": "OperatingSystemCPUSystemUtilization",
            "namespace": "ZStack/BaremetalVM"
        },
        {
            "description": "OperatingSystemCPUUserUtilization",
            "driver": "PrometheusDatabaseDriver",
            "labelNames": [
                "BaremetalVMUuid",
                "CPUNum"
            ],
            "name": "OperatingSystemCPUUserUtilization",
            "namespace": "ZStack/BaremetalVM"
        }
]
  • namespace: The namespace of a metric. A namespace is used to classify metrics of the same type.
  • name: The metric name.
  • labelNames: The label name of a metric. A label is used to filter metric data. For example, the DataVolumeCount label indicates the number of volumes on a primary storage. You can specify the PrimaryStorageUuid label to filter data so as to obtain the number of volumes on a primary storage.

GetMetricLabelValue

Obtains the available values of a metric label. Generally, a metric has one or more labels to describe the metric metadata. For example, in the ZStack/Host namespace, the CPUIdleUtilization metric includes HostUuid and CPUNum. These two fields are used to specify the host CPU to which the Idle value belongs. For example, if the system has two hosts, the HostUuid label might have two available values (that is, the UUID of each host).
GetMetricLabelValue namespace=ZStack/Host metricName=CPUIdleUtilization labelNames=CPUNum,HostUuid

Parameters

Name Description Optional Valid Value Starting Version
namespace The namespace. 2.3
metricName 2.3
labelNames The name list of the target labels. 2.3
filterLabels The label filter list. For example, you can set the HostUuid label to e47f7145f4cd4fca8e2856038ecdf3e1 to filter values specified in labelNames. Yes 2.3
startTime The start time. Yes 3.9.0
endTime The end time. Yes 3.9.0
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The user tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
Sample response:
{
    "labels": [
        {
            "CPUNum": "0",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        },
        {
            "CPUNum": "1",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        },
        {
            "CPUNum": "2",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        },
        {
            "CPUNum": "3",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        },
        {
            "CPUNum": "4",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        },
        {
            "CPUNum": "5",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        },
        {
            "CPUNum": "6",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        },
        {
            "CPUNum": "7",
            "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
        }
    ],
    "success": true
}
  • You can use filterLabels to specify the filter condition. For example, you can specify the condition to return only the available values of CPUNum for the host with the UUID a133cbcfdc1d462c9b51d7bce6ac6b11.
    GetMetricLabelValue namespace=ZStack/Host metricName=CPUIdleUtilization labelNames=CPUNum filterLabels=HostUuid=a133cbcfdc1d462c9b51d7bce6ac6b11
  • You can specify multiple conditions for filterLabels as needed.
    GetMetricLabelValue namespace=ZStack/Host metricName=CPUIdleUtilization labelNames=CPUNum filterLabels=HostUuid=a133cbcfdc1d462c9b51d7bce6ac6b11,CPUNum=1
    {
        "labels": [
            {
                "CPUNum": "1",
                "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
            }
        ],
        "success": true
    }

GetMetricData

Obtains metric data. For example,
GetMetricData namespace=ZStack/Host metricName=NetworkAllOutBytes

Parameters

Name Description Optional Valid Value Starting Version
namespace The namespace. 2.3
metricName The metric name. 2.3
startTime The start time. Yes 2.3
endTime The end time. Yes 2.3
period The interval for returning data. Yes 2.3
labels The filter labels. Yes 2.3
functions The function list. Yes 2.3
offsetAheadOfCurrentTime Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
Sample response:
{
    "data": [
        {
            "labels": {
                "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
            },
            "time": 1516363957,
            "value": 1678.9
        },
        {
            "labels": {
                "HostUuid": "a133cbcfdc1d462c9b51d7bce6ac6b11"
            },
            "time": 1516364017,
            "value": 1920.1000000000001
        }
    ],
    "success": true
}
  • In the preceding sample, value is a data value of the double type, time is an epoch time (in seconds), and labels is a label group that can be used to filter response values. The following is an example of obtaining data of the host with the UUID a133cbcfdc1d462c9b51d7bce6ac6b11:
    GetMetricData namespace=ZStack/Host metricName=NetworkAllOutByte labels=HostUuid=a133cbcfdc1d462c9b51d7bce6ac6b11
  • A label supports two filter methods: = (equal to) and =~ (regular expressions). You can use regular expressions to filter multiple label values. The following is an example of returning the metric values for the hosts with UUIDs a133cbcfdc1d462c9b51d7bce6ac6b11 and 506bd3b46a6543718488b5ba5850aaaa, respectively.
    GetMetricData namespace=ZStack/Host metricName=NetworkAllOutByte labels=HostUuid=~a133cbcfdc1d462c9b51d7bce6ac6b11|506bd3b46a6543718488b5ba5850aaaa
  • You can transfer multiple labels as filter conditions. For example,
    GetMetricData namespace=ZStack/PrimaryStorage metricName=SnapshotCount labels=PrimaryStorageUuid=b632652cc16044cdb6b4f516ed93a118,PrimaryStorageType=Ceph
  • You can use startTime and endTime to specify the time range for query. For example,
    GetMetricData namespace=ZStack/PrimaryStorage metricName=SnapshotCount labels=PrimaryStorageUuid=b632652cc16044cdb6b4f516ed93a118,PrimaryStorageType=Ceph startTime=1516364017 endTime=1516365000
    Note: Both startTime and endTime are epoch time. If you leave these two fields blank, data of the latest 1 minute will be returned by default. If you leave the endTime field blank, the current time will be used as the end time by default.
  • You can use period to specify the interval for returning data.
  • You can use functions to transfer a pair of functions for data post-processing. For example,
    GetMetricData namespace=ZStack/PrimaryStorage metricName=SnapshotCount labels=PrimaryStorageUuid=b632652cc16044cdb6b4f516ed93a118,PrimaryStorageType=Ceph startTime=1516364017 endTime=1516365000 functions=sort(by=\"value\"\\,direction=\"desc\")
  • Here, the sort function is used to sort the returned value in descending order. If you transfer multiple functions, these functions will be executed in ascending order. For example,
    GetMetricData namespace=ZStack/PrimaryStorage metricName=SnapshotCount labels=PrimaryStorageUuid=b632652cc16044cdb6b4f516ed93a118,PrimaryStorageType=Ceph startTime=1516364017 endTime=1516365000 functions=sort(by=\"value\"\\,direction=\"desc\"),limit(limit=1)
    Note: In zstack-cli, you need to translate the double quotation marks (") in a function by using backward slashes (\), and translate the commas (,) for delimiting function parameters by using double backward slashes (\\).
  • The system firstly sorts the data, and then returns the first data.
    Note: For more information about functions, see the Appendices.

PutMetricData

Note: This API is irrelevant to the UI. Therefore, you do not need to consider UI design.

Saves metrics to the backend time-series database of ZStack Cloud. You can also perform operations on the metrics by using ZWatch APIs. This allows you to customize metrics as needed. For example, if you want to add MySQL to ZWatch, you can obtain the number of concurrent MySQL connections through a script, periodically call the PutMetricData API to import data, and then use the ZWatch alarm to monitor the maximum number of MySQL connections and send alarm messages.

PutMetricData namespace=MyNamespace data='[{"metricName":"MySQLMaxConnections", "value":1000, "labels":{"ip":"10.0.0.10"}}]'

Parameters

Name Description Optional Valid Value Starting Version
namespace The custom namespace. 2.3
data The data. 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The user tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
The data field in PutMetricData can be used to obtain a data list. For example,
[{
    "metricName": "MySQLMaxConnections",
    "value": 1000,
    "labels": {
        "ip": "10.0.0.10"
    }
}]
  • metricName: The metric name.
  • value: The data value, which can be an integer or a floating-point number.
  • labels: The custom labels.
You can push multiple metrics under the same namespace at a time. For example,
[{
    "metricName": "MySQLMaxConnections",
    "value": 1000,
    "labels": {
        "ip": "10.0.0.10"
    }
}, {
    "metricName": "MySQLMemory",
    "value": 1999999999999,
    "labels": {
        "ip": "10.0.0.10"
    }
}]
Note: The namespace and metric are automatically created when data is stored. No API is available to delete namespace and metric. The related data will be automatically deleted after its Time To Live (TTL) is exceeded.

Event

Different from metrics, events can only be defined by the system. Events are generally generated by the system under specific conditions. For example, the network interruption of a host will trigger a HostDisconnected event. If you subscribe to the HostDisconnected event, you can receive notifications, such as email notifications, in case of host disconnection.

GetAllEventMetadata

Obtains all system-defined events and their metadata. For example,
GetAllEventMetadata namespace=ZStack/VM

Parameters

Name Description Optional Valid Value Starting Version
name The name of the event. Yes 3.9.0
namespace The namespace of the event. Yes 3.9.0
userTags The user tags. For more information, see CreateUserTag. Yes
systemTags The system tags. For more information, see CreateSystemTag. Yes
timeout Yes
Sample response:
{
    "events": [{
            "description": "VMStateChangedOnHost",
            "labelNames": [
                "OldState",
                "NewState",
                "SourceHostUuid",
                "DestinationHostUuid"
            ],
            "name": "VMStateChangedOnHost",
            "namespace": "ZStack/VM"
        },
        {
            "description": "VRouterDisconnected",
            "labelNames": [
                "Error"
            ],
            "name": "VRouterDisconnected",
            "namespace": "ZStack/VRouter"
        }
    ],
    "success": true
}
The metadata structure contains the following fields:
  • namespace: the namespace of the event
  • name: the event name
  • labelNames: the names of event labels

GetEventData

Obtains the events that occurred in the system. For example,
GetEventData

Parameters

Name Description Optional Valid Value Starting Version
startTime The start time. Yes 2.3
endTime The end time. Yes 2.3
limit The maximum number of returned items. Yes 2.3
offsetAheadOfCurrentTime The offset (in milliseconds) between the query time and the current time. Note that the query time is earlier than the current time. For example, if you query messages collected in the last one hour, 3600000 (the offset) will be transferred to the system. Yes 3.3.0
conditions The filter conditions. Yes 3.3.0
count Whether to query the number of events. Yes 3.3.0
endpointUuid The endpoint UUID. Yes 3.10.0
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
The following sample response contains a set of events:
{
    "events": [
        {
            "emergencyLevel": "Normal",
            "labels": {
                "NewStatus": "Connecting",
                "OldStatus": "Connected"
            },
            "name": "HostStatusChanged",
            "namespace": "ZStack/Host",
            "resourceId": "184eae9058f9477a91975f549b54f59f",
            "resourceName": "Host-1",
            "time": 1510984704006
        },
        {
            "emergencyLevel": "Normal",
            "labels": {
                "NewStatus": "Disconnected",
                "OldStatus": "Connecting"
            },
            "name": "HostStatusChanged",
            "namespace": "ZStack/Host",
            "resourceId": "184eae9058f9477a91975f549b54f59f",
            "resourceName": "Host-1",
            "time": 1510984704633
        }
    ],
    "success": true
}
The fields in the preceding example are described as follows:
  • emergencyLevel: the emergency level, including Major, Info, and Emergent
  • name: the event name
  • namespace: the namespace of the event
  • resourceId: the ID of the resource where the event occurred. If the resource belongs to ZStack Cloud, the ID is the UUID of the resource.
  • resourceName: the name of the resource where the event occurred
  • time: the time when the event occurred

GetEventData supports the following fields:

  • startTime: the start time
  • endTime: the end time. You can obtain events that occurred in a specified time period by setting the startTime and endTime fields.
  • limit: the number of returned events. If this field is not specified, up to 100 events will be returned by default.
  • conditions: the filter conditions. You can use emergencyLevel, name, namespace, and resourceName as filter conditions to obtain all the emergent events related to a host. For example,
    GetEventData conditions=namespace=ZStack/Host,emergencyLevel=Emergent

    Filter conditions support the following two types of operators: = (equal to) and =~ (regular expressions).

  • endpointUuid: the endpoint UUID

UpdateEventData

Updates event data. For example,
UpdateEventData updateMode=All

Parameters

Name Description Optional Valid Value Starting Version
dataUuid The resource UUID. Yes 3.3.0
dataStartTime The start time of the target messages. Make sure that InRange is transferred to updateMode. Yes 3.3.0
dataEndTime The end time of the target messages. Make sure that InRange is transferred to updateMode. Yes 3.3.0
updateMode The range of the target messages to be updated. Options:
  • OnlyOne: updates only the specified messages.
  • InRange: updates the messages generated in a specified time range.
  • All: updates all messages.
  • OnlyOne
  • InRange
  • All
3.3.0
readStatus The read status of the updated messages. Yes
  • Read
  • Unread
3.3.0
userTags The user tags. For more information, see CreateUserTag. Yes 3.3.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 3.3.0
timeout Yes

Alarm

You can set an alarm for metrics. When the alarm condition is reached, the alarm messages can be received via email, DingTalk, HTTP webhook, or SMS.

CreateAlarm

Creates an alarm for metrics. For example,
CreateAlarm namespace=ZStack/VM metricName=CPUAllUsedUtilization comparisonOperator=GreaterThanOrEqualTo period=300 \
repeatInterval=600 threshold=90 actions='[{"actionUuid":"2447db65cb46495e87b53d9afbad6936","actionType":"sns"}]' labels='[{"key":"VMUuid", "op":"Equal", \
"value":"1a1d7395cf74474ca52deb80c41214a1"}]' name=my-vm-alarm

Parameters

Name Description Optional Valid Value Starting Version
name The resource name. 2.3
description The detailed description of the resource. Yes 2.3
comparisonOperator The threshold comparison operator.
  • GreaterThanOrEqualTo
  • GreaterThan
  • LessThan
  • LessThanOrEqualTo
2.3
period The threshold duration. 2.3
namespace The namespace. 2.3
metricName The metric name. 2.3
threshold The threshold. 2.3
repeatInterval The alarm repeat interval. 2.3
labels The label list. Yes 2.3
actions The alarm action list. Yes 2.3
resourceUuid Yes 2.3
repeatCount The alarm repeat count. Yes 3.3.0
type The alarm type. Yes 3.3.0
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
{
  "inventory": {
    "uuid": "a6bed2b7c5154371a384f0f90dcd227e",
    "name": "VM CPU Alarm",
    "comparisonOperator": "LessThanOrEqualTo",
    "period": 60.0,
    "namespace": "ZStack/VM",
    "metricName": "org.zstack.zwatch.datatype.Metric@22c0dd63",
    "threshold": 30.0,
    "repeatInterval": 1800.0,
    "repeatCount": -1.0,
    "status": "Alarm",
    "state": "Enabled",
    "createDate": "Jan 8, 2019 4:08:43 PM",
    "lastOpDate": "Jan 8, 2019 4:08:43 PM",
    "labels": [
      {
        "uuid": "c74cb057092243ea8f838a1b4caec128",
        "key": "VMUuid",
        "operator": "\u003d",
        "value": "b5defee7d82f44c692d31e9a9d9e8e7f"
      }
    ],
    "actions": [
      {
        "alarmUuid": "433a94c9da494565a28dc4736e159297",
        "actionType": "sns",
        "actionUuid": "6d5583e8210445e3963c3784d550b8c2"
      }
    ]
  }
}

In the sample above, you created an alarm for the CPUAllUsedUtilization metric (the total CPU utilization) of the VM instance with the UUID 2c6a070b97d648c080284d395cadb855. When the threshold of the CPU utilization exceeds 90% (the comparisonOperator) and the threshold duration (the period) exceeds 300 seconds, the alarm actions will be sent to the SNS topic with the UUID 2447db65cb46495e87b53d9afbad6936. If the CPU utilization of the VM instance continuously exceeds 90% for 600 seconds (the repeatInterval) and the alarm actions are already sent, no repeat alarm actions will be triggered.

CreateAlarm includes the following fields:
  • namespace: the namespace of the metric
  • metricName: the metric name
  • comparisonOperator: the threshold comparison operator, including GreaterThanOrEqualTo (greater than or equal to), GreaterThan (greater than), LessThan (less than), and LessThanOrEqualTo (less than or equal to)
  • period: the threshold duration, in seconds.
  • repeatInterval: the alarm repeat interval, in seconds. This field is used to repeat alarms in a specified time duration. For example, if the alarm condition is to trigger alarms when the CPU utilization exceeds 90% in 1 minute, but the CPU utilization of the VM instance continuously exceeds 90% for 10 minutes, you will receive 10 alarm messages. If you set repeatInterval to 10 minutes (600 seconds), you will receive only one alarm message. If you set repeatInterval to 5 minutes (300 seconds), you will receive two alarm messages. This helps you avoid alarm flooding. If you do not set the repeatInterval field, the default value is 30 minutes (1800 seconds). You can modify the default value by modifying zwatch.alarm.repeatInterval in global settings.
  • threshold: the threshold, which is a floating-point number
  • actions: the alarm actions, that is, the actions performed by the system when the alarm is triggered. In the current version, ZWatch can only send alarm messages to SNS topics. The structure of an alarm action is as follows:
    {
    "actionUuid": "2447db65cb46495e87b53d9afbad6936",
    "actionType": "sns"
    }
    

    In the sample above, actionUuid is the UUID of the SNS topic. The value of actionType is sns, which is a fixed value. You can specify multiple alarm actions as needed.

  • labels: the labels for filtering metrics. You can use labels to match specific metrics. For example, to create alarms for a specific VM instance, you need to set the VMUuid label.
    {
        "key": "VMUuid",
        "operator": "Equal",
        "value": "1a1d7395cf74474ca52deb80c41214a1"
    }

    In the sample above, key is the label name. operator is the label comparison operator, which can be either Equal (equal to) or Regex(regular expressions). value is the label value. You can specify multiple labels as needed. You can also use GetAllMetricMetadata to obtain labels supported by each metric.

Alarm status:

The alarm status includes OK, Alarm, and InsufficientData.
  • OK: the normal status, indicating that the alarm is not triggered by the metric data
  • Alarm: the alert status, indicating that the alarm is triggered by the metric data
  • InsufficientData: the data is insufficient, indicating that the metric data is insufficient

An alarm is generally in the status of OK or Alarm.

DeleteAlarm

Deletes an alarm. For example,
DeleteAlarm uuid=f8906dd1ce5d4534b4c6b58900e795ef

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 2.3
deleteMode Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

UpdateAlarm

Updates an alarm. For example,

UpdateAlarm name=my-new-alarm threshold=99 uuid=f8906dd1ce5d4534b4c6b58900e795ef

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 2.3
name The resource name. Yes 2.3
description The detailed description of the resource. Yes 2.3
comparisonOperator The threshold comparison operator. Yes
  • GreaterThanOrEqualTo
  • GreaterThan
  • LessThan
  • LessThanOrEqualTo
2.3
period The threshold duration. Yes 2.3
threshold The threshold. Yes 2.3
repeatInterval The alarm repeat interval. Yes 2.3
repeatCount The alarm repeat count. Yes 3.3.0
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
Note:

All the preceding fields, excluding namespace, metricName, actions, and labels, can be modified.

AddActionToAlarm

Adds an action to an alarm. The actionType and actionUuid fields have the same meaning as the actions field in CreateAlarm. For example,
AddActionToAlarm alarmUuid=f8906dd1ce5d4534b4c6b58900e795ef actionType=sns actionUuid=2c6a070b97d648c080284d395cadb855

Parameters

Name Description Optional Valid Value Starting Version
alarmUuid The alarm UUID. 2.3
actionUuid The action UUID. 2.3
actionType The action type. 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

RemoveActionFromAlarm

Removes an action from an alarm. For example,
RemoveActionFromAlarm alarmUuid=f8906dd1ce5d4534b4c6b58900e795ef actionUuid=f8906dd1ce5d4534b4c6b58900e795ef

Parameters

Name Description Optional Valid Value Starting Version
alarmUuid The alarm UUID. 2.3
actionUuid The action UUID. 2.3
deleteMode Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The user tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

AddLabelToAlarm

Adds a label to an alarm. For example,

AddLabelToAlarm key=VMUUid operator=Regex value=e3206dd1ce5d4534b4c6b58900e795ef|1a1d7395cf74474ca52deb80c41214a1 uuid=f8906dd1ce5d4534b4c6b58900e795ef
Note: Here, the key, opeartor, and value fields have the same meaning as the labels field in CreateAlarm.

Parameters

Name Description Optional Valid Value Starting Version
alarmUuid The alarm UUID. 2.3
key The label key. 2.3
value The label value. 2.3
operator The operator.
  • Regex
  • Equal
2.3
resourceUuid Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The user tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

UpdateAlarmLabel

Updates an alarm label. For example,
UpdateAlarmLabel key=VMUUid operator=Regex value=e3206dd1ce5d4534b4c6b58900e795ef|1a1d7395cf74474ca52deb80c41214a1 uuid=f8906dd1ce5d4534b4c6b58900e795ef

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 3.3.0
key The label key. 3.3.0
value The label value. 3.3.0
operator The label operator.
  • Regex
  • Equal
3.3.0
userTags The user tags. For more information, see CreateUserTag. Yes 3.3.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 3.3.0
timeout Yes 3.3.0

RemoveLabelFromAlarm

Removes a label from an alarm. For example,

RemoveLabelFromAlarm uuid=f8906dd1ce5d4534b4c6b58900e795ef
Note: The UUID in the example above is the label UUID.

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 2.3
deleteMode Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

ChangeAlarmState

Changes the alarm state. For example,

ChangeAlarmState uuid=2447db65cb46495e87b53d9afbad6936 stateEvent=disable

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 2.3
stateEvent The state event.
  • enabled
  • disabled
2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The user tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
  • stateEvent:
    • enable: enable the alarm
    • disable: disable the alarm

When the alarm is disabled, you will no longer receive an alarm message. However, the alarm status will still change accordingly.

QueryAlarm

Queries an alarm. For example,

QueryAlarm namespace=ZStack/VM metricName~=%CPU%

Primitive Fields of Query

Name Description Optional Valid Value Starting Version
uuid The UUID. For more information, see Resource Property. 2.3
name The name. For more information, see Resource Property. 2.3
description The description. For more information, see Resource Property. Yes 2.3
period The threshold duration. 2.3
namespace The namespace. 2.3
metricName The metric name. 2.3
threshold The threshold. 2.3
repeatInterval The alarm repeat interval. 2.3
createDate The creation date. 2.3
lastOpDate The last operation date. 2.3
comparisonOperator 2.3
status 2.3
labels 2.3
actions 2.3
groupBy Groups rows into subgroups based on values of columns or expressions. This field is equivalent to the Group By clause in MySQL, such as groupBy=type. Yes 2.3
createDate The creation date. For more information, see Resource Property. 2.3
lastOpDate The operation date. For more information, see Resource Property. 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The user tags. For more information, see CreateSystemTag. Yes 2.3
Sample response:
{
    "inventories": [
        {
            "actions": [
                {
                    "actionType": "sns",
                    "actionUuid": "e7d6f5e23bb74e99a2777126078b551c",
                    "alarmUuid": "b632652cc16044cdb6b4f516ed93a118"
                }
            ],
            "comparisonOperator": "GreaterThanOrEqualTo",
            "createDate": "Jun 20, 2018 10:45:45 AM",
            "labels": [
                {
                    "key": "DirPath",
                    "operator": "Equal",
                    "uuid": "dfed592b822f46439195d7ce7728cdeb",
                    "value": "/var/lib/zstack/"
                }
            ],
            "lastOpDate": "Jun 20, 2018 10:45:45 AM",
            "metricName": "ManagementServerDirUsedCapacityInPercent",
            "name": "ZStack Data Directory Capacity Alarm",
            "namespace": "ZStack/System",
            "period": 60,
            "repeatInterval": 1800,
            "state": "Enabled",
            "status": "OK",
            "threshold": 70.0,
            "uuid": "b632652cc16044cdb6b4f516ed93a118"
        }
    ],
    "success": true
}

Nested and Expanded Fields of Query

Field Inventory Description Starting Version
actions Action Inventory The action status. 2.3
labels Label Inventory The action labels. 2.3

GetAlarmData

Obtains the historical messages of a resource alarm. For example,

GetAlarmData conditions=alarmUuid=~"772be6e6dba843018c71dac33555da12|36c27e8ff05c4780bf6d2fa65700f22e"

Parameters

Name Description Optional Valid Value Starting Version
startTime The start time. Yes 2.3
endTime The end time. Yes 2.3
limit The maximum number of returned messages. Yes 2.3
conditions The conditions to filter the results. Yes 2.3
count Whether to query the message count. Yes 3.3.0
excludeOtherAccount Whether to exclude messages other than the current account (only effective for SystemAdmin). Yes 3.3.0
endpointUuid The endpoint UUID. Yes 3.10.0
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
{
  "histories": [
    {
      "alarmUuid": "143b24a12d193c1992c4774dc3b34fda",
      "namespace": "ZStack/VM",
      "metricName": "CPUUsedUtilization",
      "accountUuid": "90aea7a1dfe93cf7bd3379254dddbdf9",
      "resourceUuid": "4e6bb5390d3938cb9ce830a4766ee4d8",
      "resourceType": "VmInstanceVO",
      "alarmStatus": "Alarm",
      "alarmName": "test-alarm",
      "threshold": 90.0,
      "labels": "VMUuid Equal 4e6bb5390d3938cb9ce830a4766ee4d8, CPUNum Equal 2",
      "metricValue": 10.0,
      "comparisonOperator": "LessThan",
      "time": 1.510669257141E12
    }
  ]
}
  • startTime: the start time, in milliseconds. This parameter is an epoch time.
  • endTime: the end time, in milliseconds. This parameter is an epoch time. You can obtain the audit messages in a certain period of time by specifying the startTime and endTime parameters.
  • limit: the maximum number of returned messages. If the limit is not specified, the default value is 100. If the limit is greater than the maximum number of returned messages, all messages are returned.
  • endpointUuid: the endpoint UUID
  • conditions: the filter condition array. You can specify filter conditions to return specific messages. Filter conditions are expressed in condition operator value format, such as error=~".+" (note that there are no spaces on either side of the operator). Operators can be = (equal to) or = =~ (regular expressions). The filter condition includes the following elements:
    • alarmUuid: the alarm UUID
    • namespace: the namespace
    • metricName: the metric name
    • accountUuid: the UUID of the account to which the alarm belongs
    • resourceUuid: the UUID of the resource associated with the alarm
    • resourceType: the type of the resource associated with the alarm
    • alarmStatus: the alarm status

The structure of the alarm historical messages contains the following fields:

  • alarmUuid: the alarm UUID
  • namespace: the namespace
  • metricName: the metric name
  • accountUuid: the UUID of the account to which the alarm belongs
  • resourceUuid: the UUID of the resource associated with the alarm
  • resourceType: the type of the resource associated with the alarm
  • alarmStatus: the alarm status
  • alarmName: the alarm name
  • threshold: the alarm threshold
  • period: the alarm duration
  • labels: the alarm label list, which is a string expressed as "label1 = value1, lable2 = value2"
  • metricValue: the metric value
  • time: the time when the alarm was triggered

UpdateAlarmData

Updates the historical messages of an alarm. For example,
UpdateAlarmData updateMode=All

Parameters

Name Description Optional Valid Value Starting Version
dataUuid The resource UUID. Yes 3.3.0
dataStartTime The start time of the target messages. Make sure that the InRange field is transferred to updateMode. Yes 3.3.0
dataEndTime The end time of the target messages. Make sure that the InRange field is transferred to updateMode. Yes 3.3.0
updateMode The range of the target messages to be updated. Options:
  • OnlyOne: updates only the specified messages.
  • InRange: updates the messages generated in a specified time range.
  • All: updates all messages.
  • OnlyOne
  • InRange
  • All
3.3.0
readStatus The read status of the updated messages. Yes
  • Read
  • Unread
3.3.0
userTags The user tags. For more information, see CreateUserTag. Yes 3.3.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 3.3.0
timeout Yes

UpdateActiveAlarmTemplate

Updates the template of a one-click alarm. For example,
UpdateActiveAlarmTemplate uuid=ea8aa7b6b2e43d4a9f3a19ba121ab72a

Parameters

Name Description Optional Valid Value Starting Version
uuid The template UUID. 4.7.0
alarmName The template name. Yes 4.7.0
comparisonOperator The threshold comparison operator. Yes
  • GreaterThanOrEqualTo
  • GreaterThan
  • LessThan
  • LessThanOrEqualTo
4.7.0
period The threshold comparison operator. Yes 4.7.0
threshold The threshold. Yes 4.7.0
repeatInterval The alarm repeat interval. Yes 4.7.0
repeatCount The alarm repeat count. Yes 4.7.0
emergencyLevel The alarm emergency level. Yes
  • Emergent
  • Important
  • Normal
4.7.0
labels Yes 4.7.0
userTags The user tags. For more information, see CreateUserTag. Yes 4.7.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 4.7.0

ChangeEventSubscriptionState

Changes the state of an event alarm. For example,
ChangeEventSubscriptionState uuid=f8906dd1ce5d4534b4c6b58900e795ef state=Disabled

Parameters

Name Description Optional Valid Value Starting Version
uuid The volume UUID. 4.7.0
state The event alarm state.
  • Enabled
  • Disabled
4.7.0
userTags The user tags. For more information, see CreateUserTag. Yes 4.7.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 4.7.0

Event Subscription

You can subscribe to events to receive notifications via email, DingTalk, HTTP webhook, or SMS when an event occurs (for example, a VM instance is unexpectedly down and restarted by HA). Event subscription is a kind of an alarm for events.

SubscribeEvent

Subscribes to an event. For example,

SubscribeEvent namespace=ZStack/Host eventName=HostStatusChanged actions='[{"actionType":"sns", "actionUuid":"2447db65cb46495e87b53d9afbad6936"}]' labels='[{"key":"NewStatus", "op":"Equal", "value":"Disconnected"}]'

Parameters

Name Description Optional Valid Value Starting Version
namespace The namespace. 2.3
eventName The event name. 2.3
actions The event actions. Yes 2.3
labels The event labels. Yes 2.3
resourceUuid Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
name The resource name. Yes 3.0.0
timeout Yes
{
    "inventory": {
        "actions": [{
            "actionType": "sns",
            "actionUuid": "2447db65cb46495e87b53d9afbad6936",
            "subscriptionUuid": "88c064e2f0004597b0a7161fbe9bcd0c"
        }],
        "createDate": "Jan 24, 2018 1:16:38 PM",
        "eventName": "HostStatusChanged",
        "labels": [{
            "key": "NewStatus",
            "operator": "Equal",
            "value": "Disconnected"
        }],
        "lastOpDate": "Jan 24, 2018 1:16:38 PM",
        "namespace": "ZStack/Host",
        "state": "Enabled",
        "uuid": "88c064e2f0004597b0a7161fbe9bcd0c"
    },
    "success": true
}

Parameters:

  • namespace: the event namespace
  • eventName: the event name
    Note: You can use GetAllEventMetadata to obtain system-defined events.
  • actions: the event actions. Similar to alarm actions, you can only send notifications to SNS topics currently.
    {
    "actionUuid": "2447db65cb46495e87b53d9afbad6936",
    "actionType": "sns"
    }

    In the sample above, actionUuid is the UUID of the SNS topic, and the value of actionType is sns, which is a fixed value. You can specify multiple alarm actions as needed.

  • labels: the labels for filtering events. You can use labels to match specific events. For example, you can use the NewStatus label to subscribe to the event when the host status changes to Disconnected.
    {
        "key": "NewStatus",
        "operator": "Equal",
        "value": "Disconnected"
    }

    The label field is the same as that used for creating an alarm.

UnsubscribeEvent

Unsubscribes from an event. For example,
UnsubscribeEvent uuid=88c064e2f0004597b0a7161fbe9bcd0c

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 2.3
deleteMode Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

QueryEventSubscription

Queries an event subscription. For example,
QueryEventSubscription eventName=HostStatusChanged

Primitive Fields of Query

Name Description Optional Valid Value Starting Version
uuid The UUID. For more information, see Resource Property. 2.3.1
namespace The namespace. 2.3.1
eventName The event name. 2.3.1
state 2.3.1
actions The action status. 2.3.1
labels The action labels. 2.3.1
groupBy Groups rows into subgroups based on values of columns or expressions. This field is equivalent to the Group By clause in MySQL, such as groupBy=type. Yes 2.3.1
createDate The creation date. For more information, see Resource Property. 2.3.1
lastOpDate The last operation date. For more information, see Resource Property. 2.3.1
userTags The user tags. For more information, see CreateUserTag. Yes 2.3.1
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3.1

Nested and Expanded Fields of Query

Field Inventory Description Starting Version
actions Actions Inventory The action status. 2.3
labels Labels Inventory The action labels. 2.3

UpdateEventSubscriptionLabel

Updates the label of an event subscription. For example,
UpdateEventSubscriptionLabel uuid=cfb859d412933a1da57ae99e2aa442ce key=VMUuid value=27e59f9fe7ed46118a2f6b8a383ce494 operator=Equal

Parameters

Name Description Optional Valid Value Starting Version
uuid The label UUID of the original event subscription. 3.9.0
key The new name of the label. 3.9.0
value The new value of the label. 3.9.0
operator The new operator of the label.
  • Regex
  • Equal
3.9.0
userTags The user tags. For more information, see CreateUserTag. Yes 3.9.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 3.9.0
timeout Yes

Text Template

When an alarm is triggered or a subscription event occurs, the SNS topic you specified before will receive the corresponding alarm messages or event messages. You can format the received messages by customizing the text template.

The default email text template is as follows:

The status of the alarm ${ALARM_NAME} changes to ${ALARM_CURRENT_STATUS}.

Alarm details:
UUID: ${ALARM_UUID}
Resource namespace: ${ALARM_NAMESPACE}
Trigger condition: ${ALARM_METRIC} ${ALARM_COMPARISON_OPERATOR} ${ALARM_THRESHOLD}
Trigger condition duration: ${ALARM_DURATION} seconds
Previous status: ${ALARM_PREVIOUS_STATUS}
Current value: ${ALARM_CURRENT_VALUE}
Label: ${ALARM_LABELS.join(",")}

If you do not modify the text template, the content in the alarm email you received is similar to the content above. Only the variables in the text template will be replaced with the corresponding alarm content. For example, ${ALARM_NAME} may be changed to Web server CPU. You can use the variables to customize your own alarm text templates.

Currently, you can customize a text template if you select the email or DingTalk endpoint. The text template for the HTTP webhook endpoint cannot be customized because the template uses the JSON format. The HTTP text template is as follows:

{
    "ALARM_UUID": "27f8791237ed45b4815be744a2b2fd8a",
    "ALARM_NAMESPACE": "ZStack/VM",
    "ALARM_LABELS": ["VMUuidEqual26643ce4b5604b128e3f7bb3d61ef779"],
    "ALARM_PREVIOUS_STATUS": "InsufficientData",
    "ALARM_THRESHOLD": 10.0,
    "ALARM_METRIC": "CPUUsedUtilization",
    "ALARM_DURATION": 1,
    "ALARM_CURRENT_VALUE": 101.0,
    "ALARM_COMPARISON_OPERATOR": "GreaterThan",
    "ALARM_CURRENT_STATUS": "Alarm",
    "ALARM_NAME": "alarm"
}

Template Variables

ZWatch provides a set of template variables for alarms and event subscriptions. These variables can be referenced by alarm text templates. When generating alarm text, ZWatch replaces these variables with the corresponding values of an alarm or event. The syntax used by the alarm text template is based on the Groovy GString Template. Most users can reference the variable values by simply using ${}.

The following are variables supported by alarms and event subscriptions, respectively:
  • Alarm variables
    • ALARM_NAME: the alarm name
    • ALARM_UUID: the alarm UUID
    • ALARMCOMPARISONOPERATOR: the alarm operator
    • ALARM_METRIC: the alarm metric
    • ALARM_NAMESPACE: the alarm namespace
    • ALARM_THRESHOLD: the alarm threshold
    • ALARMLABELS: the alarm label array. You can use *${ALARMLABELS.join(",")}* to combine the labels into a comma-separated string.
    • ALARM_DURATION: the alarm duration when a metric value exceeds the threshold
    • ALARMPREVIOUSSTATUS: the alarm status before the alarm is triggered
    • ALARMCURRENTSTATUS: the current status of the alarm
    • ALARMCURRENTVALUE: the metric value when the alarm is triggered
  • Event subscription variables
    • EVENT_NAMESPACE: the event namespace
    • EVENT_NAME: the event name
    • EVENTLABELS: the event label array. You can use *${EVENTLABELS.join(",")}* to combine the labels into a comma-separated string.
    • EVENTEMERGENCYLEVEL: the event emergency
    • EVENTRESOURCEID: the ID of the resource where the event occurred
    • EVENTRESOURCENAME: the name of the resource where the event occurred
    • EVENT_ERROR: If the event is related to an error, such as the network error that resulted in a host disconnection event, this field contains a string that describes the error. If no error exists, the field is an empty string expressed as “”.
    • EVENT_TIME: the time when the event occurred. This variable is a string.
    • PARAMEVENTSUBSCRIPTION_UUID: the UUID of the subscribed event.

CreateSNSTextTemplate

Creates an SNS text template. For example,

CreateSNSTextTemplate name=my-template defaultTemplate=true applicationPlatformType=Email template="${ALARM_NAME} The status is changed to ${ALARM_CURRENT_STATUS}"

Parameters

Name Description Optional Valid Value Starting Version
name The resource name. 2.3
description The detailed description of the resource. Yes 2.3
applicationPlatformType The type of the SNS application platform. 2.3
template The template text. 2.3
recoveryTemplate The recovery template text, which is a string. Yes 3.4.0
defaultTemplate Whether to set the template as the default template. Yes 2.3
resourceUuid Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
{
    "inventory": {
        "applicationPlatformType": "Email",
        "createDate": "Jan 24, 2018 7:40:02 PM",
        "defaultTemplate": true,
        "lastOpDate": "Jan 24, 2018 7:40:02 PM",
        "name": "my-template",
        "template": "${ALARM_NAME} The status is changed to ${ALARM_CURRENT_STATUS}",
        "uuid": "0ce9954a578b4795b02ff6b737aa86df"
    },
    "success": true
}
  • applicationPlatformType: the type of the SNS application platform, including email, HTTP webhook, DingTalk, and SMS
  • defaultTemplate: whether to set the template as the default template. If set to true, ZWatch uses this template to send alarm messages to the corresponding SNS endpoint. For example, if applicationPlatformType=Email and defaultTemplate=true, all alarm messages sent via email will use this alarm template. You can use this field to create multiple templates. To use a certain template, you only need to set the defaultTemplate field of the template to true.
  • template: the template text

DeleteSNSTextTemplate

Deletes an SNS text template. For example,
DeleteSNSTextTemplate uuid=36c27e8ff05c4780bf6d2fa65700f22e

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 2.3
deleteMode Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The user tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

UpdateSNSTextTemplate

Updates an SNS text template. For example,
UpdateSNSTextTemplate uuid=0ce9954a578b4795b02ff6b737aa86df defaultTemplate=false

Parameters

Name Description Optional Valid Value Starting Version
uuid The resource UUID. 2.3
name The resource name. Yes 2.3
description The detailed description of the resource. Yes 2.3
template The template text. Yes 2.3
recoveryTemplate The recovery template text, which is a string. Yes 3.4.0
defaultTemplate Whether to set the template as the default template. Yes 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes

QuerySNSTextTemplate

Queries an SNS text template. For example,
QuerySNSTextTemplate template~="%This is the SNS text templated to be queried.%

Primitive Fields of Query

Name Description Optional Valid Value Starting Version
uuid The UUID. For more information, see Resource Property. 2.3
name The name. For more information, see Resource Property. 2.3
description The description. For more information, see Resource Property. Yes 2.3
applicationPlatformType The type of the SNS application platform. 2.3
template The template text. 2.3
defaultTemplate Whether to set the template as the default template. 2.3
groupBy Groups rows into subgroups based on values of columns or expressions. This field is equivalent to the Group By clause in MySQL, such as groupBy=type. Yes 2.3
createDate The creation date. For more information, see Resource Property. 2.3
lastOpDate The last operation date. For more information, see Resource Property. 2.3
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3

CreateAliyunSmsSNSTextTemplate

Creates an Aliyun SMS SNS text template. For example,
CreateAliyunSmsSNSTextTemplate sign=test alarmTemplateCode=SMS_153055065 eventTemplateCode=SMS_153055066 name=aliyunSMS applicationPlatformType=AliyunSms template=Alarm ${ALARM_NAME} changes status to ${ALARM_CURRENT_STATUS}

Parameters

Name Description Optional Valid Value Starting Version
sign The SMS signature. 3.7.0
alarmTemplateCode The resource alarm template code. 3.7.0
eventTemplateCode The event alarm template code. 3.7.0
eventTemplate The event alarm template text. Yes 3.7.0
name The template name. 3.7.0
description The detailed description of the template. Yes 3.7.0
applicationPlatformType The type of the SNS application platform. 3.7.0
template The resource alarm template text. 3.7.0
recoveryTemplate The recovery template text. Yes 3.7.0
defaultTemplate Whether to set the template as the default template. Yes 3.7.0
resourceUuid Yes 3.7.0
tagUuids The tag UUID list. Yes 3.7.0
userTags The user tags. For more information, see CreateUserTag. Yes 3.7.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 3.7.0
timeout Yes

UpdateAliyunSmsSNSTextTemplate

Updates an Aliyun SMS SNS text template. For example,
UpdateAliyunSmsSNSTextTemplate uuid=d7e89644ef273ca8baf451bf845553fd

Parameters

Name Description Optional Valid Value Starting Version
alarmTemplateCode The resource alarm template code. Yes 3.7.0
sign The SMS message signature. Yes 3.7.0
eventTemplateCode The event alarm template code. Yes 3.7.0
eventTemplate The event alarm template text. Yes 3.7.0
uuid The template UUID. 3.7.0
name The template name. Yes 3.7.0
description The detailed description of the template. Yes 3.7.0
template The resource alarm template text. Yes 3.7.0
recoveryTemplate The recovery template text. Yes 3.7.0
defaultTemplate Whether to set the template as the default template. Yes 3.7.0
userTags The user tags. For more information, see CreateUserTag. Yes 3.7.0
systemTags The system tags. For more information, see CreateSystemTag. Yes 3.7.0
timeout Yes

QueryAliyunSmsSNSTextTemplate

Queries an Aliyun SMS SNS text template. For example,
QueryAliyunSmsSNSTextTemplate 

Audit

ZWatch provides the API audit feature, which allows you to view API operations on a certain resource or all resources. The following is a sample of an API audit record:

        {
            "apiName": "org.zstack.header.vm.APICreateVmInstanceMsg",
            "duration": 3260,
            "operatorAccountUuid": "36c27e8ff05c4780bf6d2fa65700f22e",
            "requestDump": "{"description":"","l3NetworkUuids":["d914360d1b2a42a68f91df0c8863f716"],"dataDiskOfferingUuids":[],"name":"vm","systemTags":["usbRedirect::false","vmConsoleMode::vnc"],"instanceOfferingUuid":"5c5720c9feba4196a9a9d3cb844a77b7","strategy":"InstantStart","imageUuid":"1194b7d10d3345e08b21847165f0b349"}",
            "requestUuid": "30a3cebb29173fa7a60f4e96d397ef1d",
            "resourceType": "VmInstanceVO",
            "resourceUuid": "ec54f53da5204a63954beea0a7782804",
            "responseDump": "{"inventory":{"uuid":"ec54f53da5204a63954beea0a7782804","name":"vm","description":"","zoneUuid":"fad25e2987a746f186896e3234469263","clusterUuid":"6da3fd94b7c5412088e722a773f17796","imageUuid":"1194b7d10d3345e08b21847165f0b349","hostUuid":"9778a9bc6db84ea9847c2023f13cbc1e","lastHostUuid":"9778a9bc6db84ea9847c2023f13cbc1e","instanceOfferingUuid":"5c5720c9feba4196a9a9d3cb844a77b7","rootVolumeUuid":"726f19724a3e4783801d86a7021d2be1","platform":"Linux","defaultL3NetworkUuid":"d914360d1b2a42a68f91df0c8863f716","type":"UserVm","hypervisorType":"KVM","memorySize":1073741824,"cpuNum":1,"cpuSpeed":0,"allocatorStrategy":"LeastVmPreferredHostAllocatorStrategy","createDate":"Dec 21, 2017 1:14:02 PM","lastOpDate":"Dec 21, 2017 1:14:05 PM","state":"Running","vmNics":[{"uuid":"6ddc4064387c4f0f88d5d1e422a4f22a","vmInstanceUuid":"ec54f53da5204a63954beea0a7782804","l3NetworkUuid":"d914360d1b2a42a68f91df0c8863f716","ip":"10.0.0.47","mac":"fa:8e:06:53:90:00","netmask":"255.255.255.0","gateway":"10.0.0.1","deviceId":0,"createDate":"Dec 21, 2017 1:14:02 PM","lastOpDate":"Dec 21, 2017 1:14:02 PM"}],"allVolumes":[{"uuid":"726f19724a3e4783801d86a7021d2be1","name":"ROOT-for-vm","description":"Root volume for VM[uuid:ec54f53da5204a63954beea0a7782804]","primaryStorageUuid":"4966a9f63d274ad0bfc2f59367bf7459","vmInstanceUuid":"ec54f53da5204a63954beea0a7782804","rootImageUuid":"1194b7d10d3345e08b21847165f0b349","installPath":"/Cloud_ps/rootVolumes/acct-36c27e8ff05c4780bf6d2fa65700f22e/vol-726f19724a3e4783801d86a7021d2be1/726f19724a3e4783801d86a7021d2be1.qcow2","type":"Root","format":"qcow2","size":12682240,"actualSize":7995392,"deviceId":0,"state":"Enabled","status":"Ready","createDate":"Dec 21, 2017 1:14:02 PM","lastOpDate":"Dec 21, 2017 1:14:02 PM","isShareable":false}]},"success":true}",
            "responseUuid": "d6c29c03c894439983f1afd06cb862a9",
            "sessionUuid": "68e54d9719ef42f0807a66eef5483bed",
            "time": 1513833245301
        }
  • apiName: the API name
  • duration: the time consumed to perform the API, in milliseconds
  • operatorAccountUuid: the UUID of the account that performs the API
  • requestDump: the API request. Sensitive fields (such as passwords) are not contained in the request.
  • responseDump: the API response
  • requestUuid: the API request UUID
  • resourceType: the resource type. This field does not exist if the API is not a resource-specific operation
  • responseUuid: the API response UUID
  • sessionUuid: the account session UUID
  • time: the time when the API request is received, in milliseconds. This field is an epoch time.
  • error: If an API fails to be performed, this field will contain a string that describes the error. This field will not be displayed if the API is successfully performed.

The audit feature records only operation-related APIs, including the create, modify, and delete operation. Read APIs (including all Query and Get APIs) are not recorded. If an API operation is associated with multiple resources, such as attaching primary storage to a cluster, an audit record will be generated for each resource.

GetAuditData

Obtains data audit records. The returned records are sorted by the time field in descending order. For example,

GetAuditData conditions=error=~".+"

Parameters

Name Description Optional Valid Value Starting Version
startTime The start time. Yes 2.3
endTime The end time. Yes 2.3
limit The maximum number of returned records. Yes 2.3
labels The filter label list. Yes 2.3
auditType The audit type. Yes
  • Login
  • Resource
3.5.0
userTags The user tags. For more information, see CreateUserTag. Yes 2.3
systemTags The system tags. For more information, see CreateSystemTag. Yes 2.3
timeout Yes
  • startTime: the start time, in milliseconds. This parameter is an epoch time.
  • endTime: the end time, in milliseconds. This parameter is an epoch time. You can obtain the audit records in a certain period of time by specifying the startTime and endTime parameters.
  • limit: the maximum number of returned records. If the limit is not specified, the default value is 100. If the limit is greater than the maximum number of returned records, all records are returned.
  • conditions: the filter condition array. You can specify filter conditions to return specific records. Filter conditions are expressed in condition operator value format, such as error=~".+" (note that there are no spaces on either side of the operator). Operators can be = (equal to) or = =~ (regular expressions). The filter condition includes:
    • resourceUuid: the resource UUID
    • resourceType: the resource type
    • apiName: the API name
    • error: the error message
    • operatorAccountUuid: the account UUID
    Note:

    You can use error=~".+" to match all APIs whose error field is not empty. That is, error=~".+" indicates to return all failed APIs, while error = "" indicates to return all successful APIs.

CLI Command Manual | 4.8.38 | ZStack Cloud · ZCF | ZStack Resource Center