Skip to content

Configuration Manual for the "Alibaba Cloud - DDoS Basic Protection" Collector

Before reading this, please first read:

Before using this collector, you must install the 'Integration Core Package' and its associated third-party dependency packages

This script's code execution depends on ECS, EIP, SLB instance object collection. If custom object collection for corresponding instance objects is not configured, this script will not be able to collect data for the corresponding instances.

1. Configuration Structure

The configuration structure of this collector is as follows:

Field Type Required Description
regions list Required List of regions to collect data from
regions[#] str Required Region ID. For example: 'cn-qingdao-cm5-a01', see the appendix for query method
instance_type list Required List of instance types to collect data from
instance_type[#] str Required Instance type, available parameters: 'ecs','eip','slb'

2. Configuration Example

Specifying a Region

Collecting DDoS Basic Protection instance data

Python
1
2
3
4
aliyun_configs = {
    'regions'      : ['cn-qingdao-cm5-a01'],
    'instance_type': ['ecs'],
}

3. Data Reporting Format

After data synchronizes normally, it can be viewed in the 'LOGs' section of TrueWatch.

Example of reported data:

JSON
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
{
  "measurement": "aliyun_ddos_event",
  "tags": {
    "DdosType"    : "blackhole",
    "DdosStatus"  : "mitigating",
    "InstanceId"  : "i-bp1jbf3zyzssbxxxxxxx",
    "RegionId"    : "cn-qingdao-cm5-a01",
    "InstanceType": "ecs"
  },
  "fields": {
    "StartTime"      : "1637812279000",
    "EndTime"        : "1637812279000",
    "UnBlackholeTime": "1637812279000",
    "DelayTime"      : "1637812279000",
    "message"        : "{JSON serialized instance data}"
  }
}

Fields in tags and fields may change with subsequent updates

If ecs instance collection results in log error messages such as HTTP Status: 400 Error:NotHasInternetIp this instance not has internet, it indicates that the ecs instance does not have a public IP and thus cannot collect DDoS Basic Protection information

fields.message is a string after JSON serialization

All time parameters are represented as timestamps in units: milliseconds

X. Appendix

Alibaba Cloud DDoS "Region IDs"

You can call DescribeRegions to query all region IDs; please refer to the official Alibaba Cloud documentation: