--- title: "Alibaba Cloud collector" canonical: "https://docs.devo.com/space/latest/250871862/Alibaba%20Cloud%20collector" format: markdown --- > Macro (excerpt-include) > Macro (toc) ## Purpose An analyst wants to detect unauthorized management activities in [Alibaba Cloud](https://eu.alibabacloud.com/). Using the Alibaba Cloud collector to send cloud activity logs to Devo, the analyst will find unusual API calls from unexpected locations. As a result, the analyst will revoke the malicious access keys, preventing them from compromising cloud resources. ## Example tables | **Table** | **Description** | | --- | --- | | cloud.alibaba.actiontrail.events | API and console activity events | | cloud.alibaba.log_service.events | Events from Alibaba Log Service | ## Configuration requirements To run this collector, there are some configurations detailed below that you need to consider. | **Configuration** | **Details** | | --- | --- | | Access key ID and Secret ID | You will need to obtain the Access Key ID and Secret ID to configure this collector. | | Create a Trail | You will need a configured ActionTrail trail to query. | | Log store | You will need a Log Store that contains Action Trail events - this is optional-. | ## Authorize it 1. Login to the Alibaba Cloud Management Console. 2. Go to the **Access Key Management** page from your account profile. 3. Create a new **Access Key**. 4. Make note of the **Access Key ID** and **Access Key Secret**. 5. These can only be viewed once. 6. Create a **Resource Access Management (RAM) user** with read-only permissions. 7. Assign the following **permissions** to the RAM user: 1. *ActionTrail:LookupEvents* 2. *ActionTrail:GetHistoryEvents* 3. *Log:GetLogStore* 4. *Log:GetProject* 5. *Log:ListLogStores* 6. *Log:ListShards* 7. *Log:GetCursor* 8. *Log:PullLogs* ## Run it In the Cloud Collector App, [create](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131) a **Alibaba Cloud** collector instance. Insert this parameters template, replacing the values enclosed in `< >`. The `id` must be a unique [five digit number](https://www.random.org/integers/?num=1&min=10000&max=99999&col=5&base=10&format=html&rnd=new). ``` "inputs": { "alibaba": { "id": "", "services": { "actiontrail": { "region_id": "", "queue_name": "" }, "actiontrail_log_service": { "endpoint": "", "project_name": "", "logstore_name": "" }, "credentials": { "access_key_id": "", "access_key_secret": "" } } } } ``` ## Monitor it Create an [inactivity alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126785) to detect interruptions of transfer of data from the source using the query ``` from cloud.alibaba.actiontrail.events where toktains(hostchain,"collector-") select split(hostchain,"-",1) as collector_id ``` Set the inactivity alert to keep track of the `collector_id`. ## Parameters ### Example ``` { "global_overrides": { "debug": false }, "inputs": { "alibaba": { "id": "", "enabled": true, "credentials": { "access_key_id": "", "access_key_secret": "" }, "services": { "actiontrail": { "region_id": "", "initial_start_time_in_utc": "", "seconds_offset": "", "override_tag": "" }, "actiontrail_log_service": { "endpoint": "", "project_name": "", "logstore_name": "", "initial_start_time_in_utc": "", "seconds_offset": "", "override_tag": "" }, "access_log_service": { "endpoint": "", "project_name": "", "logstore_name": "", "initial_start_time_in_utc": "", "seconds_offset": "", "override_tag": "" } } } } } ``` ### Details | **Parameter** | **Data Type** | **Necessity** | **Details** | | --- | --- | --- | --- | | `id` | integer | Mandatory | Use this param to give an unique id to this input service.
This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision. | | `inputs` | boolean | Mandatory | Use this param to enable or disable the given input logic when running the collector. If the value is `true`, the input will be run. If the value is `false`, it will be ignored. | | `access_key_id` | integer | Mandatory | The Alibaba access key ID | | `access_key_secret` | string | Mandatory | The Alibaba access key secret | | `region_id` | string | Mandatory | The region ID (e.g. `cn-hangzhou`) whose ActionTrail events will be queried when using the standard ActionTrail API service. | | `endpoint` | string | Mandatory | The log store endpoint ([e.g.us-east-1.log.aliyuncs.com](http://e.g.us-east-1.log.aliyuncs.com/)) | | `project_name` | string | Mandatory | The log store project name | | `logstore_name` | string | Mandatory | The log store name | | `seconds_offset` | integer | Optional | The amount of seconds to offset from the puller time to begin fetching results. Alibaba recommends up to 10 minutes to allow all events to be ingested into ActionTrail. | | `initial_start_time_in_utc` | string | Optional | This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (1 month back for example) before downloading new events.
Please note that setting the `initial_start_time_in_utc` for a particular service will override any `initial_start_time_in_utc` set in the commons level.
Format: `YYYY-mm-ddTHH:MM:SS.sssZ` | | `queue_name` | string | Mandatory | Use this param to provide queue name, to fetch the messages from. | | `wait_seconds` | integer | Optional | The amount of seconds to wait for the messages if not available in queue. | | `override_tag` | string | Optional | Custom devo tag value | ## Troubleshooting This collector has different security layers that detect both an invalid configuration and abnormal operation. This table will help you detect and resolve the most common errors. | **ErrorType** | **Error Id** | **Error Message** | **Cause** | **Solution** | | --- | --- | --- | --- | --- | | InitVariablesError | 1 | `Datetime format is not present in module globals.` | The datetime format is not provided | Contact the developer with exact error message. | | InitVariablesError | 2 | `initial_start_time_in_utc is not set as per the datetime_format : {datetime_format}` | The date in config is not as per required format | Ensure the date format is correct. | | InitVariablesError | 3 | `Date {initial_start_time_str} is in the future` | The date in config is greater than current time | Ensure the datetime is less than current time | | SetupError | 100 | `Failed to build authentication. Reason str(e)` | Issue while creating authentication. | Check the credentials, and service_name. Contact the developer with exact error message. | | SetupError | 101 | `Authentication test failed. Reason str(e)` | Data is not pullable with given credentials. | Check the credentials. Contact the developer with exact error message. | | PullError | 300 | `Error during pull: str(e)` | Alibaba actiontrail events puller is failing. | Contact the developer with exact error message. | | PullError | 301 | `Error during pull: str(e)` | Alibaba log service puller is failing | Contact the developer with exact error message. | ## API Endpoints | **Endpoint** | **Service** | **Table** | | --- | --- | --- | | `ActionTrail core SDK` | `actiontrail` | `cloud.alibaba.actiontrail.events` | | `Log Service SDK` | `actiontrail_log_service` | `cloud.alibaba.log_service.events` | | `Log Service SDK` | `access_log_service` | `cloud.alibaba.log_service.access_log` | | `Log Service SDK` | `db_log_service` | `cloud.alibaba.log_service.db_log` | | `Log Service SDK` | `internal_audit_service` | `cloud.alibaba.log_service.audit_service_log` | | `MNS SDK` | `smq` | `my.app.alibaba.smq` | | `Log Service sdk` | `custom_log_service` | `my.app.alibaba.log` | ## Devo collector features | **Feature** | **Details** | | --- | --- | | Allow parallel downloading (`multipod`) | `Not allowed` | | Running environments | `Collector server` | | Populated Devo events | `Table` | | Flattening preprocessing | `No` | ## Release Notes - **Version 1.5.0** (2025-06-30) - Fixed an issue where ingestion would stop if an event contained invalid JSON; now, such events are skipped or ingested as unparsed with a warning, allowing log collection to continue uninterrupted. - Updated DCSDK from 1.15.0 to 1.16.3 - **Version 1.4.0** (2025-04-09) - Added custom service for logs. - **Version 1.3.1** (2025-03-26) - Fixed issue with byte handling in response. - **Version 1.3.0** (2025-03-17) - Updated DCSDK from 1.14.0 to 1.15.0 - Upgraded dcsdk-docker-base-image to 1.4.1 - Added new smq service. - **Version 1.2.0** (2025-02-21) - Improved error handling related to incompatible response for actiontrail log service. - Updated DCSDK from 1.7.2 to 1.14.0 - Upgraded dcsdk-docker-base-image to 1.4.0 - Fixed unexpected PullError in actiontrail log service for missing eventVersion. - Added new services - Access_log_service - Db_log_service - Internal_audit_service - Added unittests - **Version 1.1.0 **(2023-06-01) - Improved log retrieval speed by moving from time-based pagination to cursor/shard-based pagination. - Updated DCSDK from 1.5.1 to 1.7.2 - **Version 1.0.0 **(2022-11-30) - Initial release of Alibaba Cloud collector with support for ActionTrail and Log Service events.