Skip to content

Collector 'Alibaba Cloud-DDoS Basic Protection' Configuration Manual

Before reading this document, please read:

Tip

Before using this collector, you must install the "Integration Core Package" and its accompanying third-party dependency packages.

Tip

The code execution of this script depends on the collection of ECS, EIP, and SLB instance objects. If the custom object collection for the corresponding instances is not configured, this script cannot collect the corresponding instance data.

1. Configuration Structure

The configuration structure of this collector is as follows:

Field Type Required Description
regions list Required List of regions to be collected
regions[#] str Required Region ID. For example: 'cn-qingdao-cm5-a01', see appendix for query method
instance_type list Required Types of instances to be collected
instance_type[#] str Required Instance type, optional parameters: 'ecs','eip','slb'

2. Configuration Example

Specified Region

Collect DDoS basic protection instance data

aliyun_configs = {
    'regions'      : ['cn-qingdao-cm5-a01'],
    'instance_type': ['ecs'],
}

3. Data Reporting Format

After data is successfully synchronized, you can view the data in the "LOG" of TrueWatch.

An example of the reported data is as follows:

{
  "measurement": "aliyun_ddos_event",
  "tags": {
    "DdosType"    : "blackhole",
    "DdosStatus"  : "mitigating",
    "InstanceId"  : "i-bp1jbf3zyzssbxxxxxxx",
    "RegionId"    : "cn-qingdao-cm5-a01",
    "InstanceType": "ecs"
  },
  "fields": {
    "StartTime"      : "1637812279000",
    "EndTime"        : "1637812279000",
    "UnBlackholeTime": "1637812279000",
    "DelayTime"      : "1637812279000",
    "message"        : "{Instance JSON data}"
  }
}
Note

The fields in tags and fields may change with subsequent updates.

Note

If the log information reports an error message "HTTP Status: 400 Error:NotHasInternetIp this instance not has internet" when collecting ecs instances, it means that the ecs instance does not have a public IP and cannot collect DDoS basic protection information.

Tip

fields.message is a JSON serialized string.

Tip

Time parameters are represented using timestamps in milliseconds.

X. Appendix

Alibaba Cloud DDoS "Region ID"

You can call DescribeRegions to query all region IDs. Please refer to the official Alibaba Cloud documentation: