amazon web services - Retrieving Username from CloudTrail logs for RunInstances event -


we have large number of ec2 instances running in aws 1 year. trying perform clean activity unused instances , based on username using have launched instances.

i have tried downloading cloudtrail logs s3 bucket , tried filtering username , 'runinstances' event may find user launched instance , instance details.

the following script used download cloudtrail logs single folder, unzip them , filter instances 'runinstances' event , give count of instances.

i need on retrieving usernames each log wiht 'runinstances' event , stopping instances.

my script:

#!bin/sh  s3url="s3://s3bucket/awscloudtraillogs/<accountno>/cloudtrail/region/2016/"   (( i=1; i<=12; i++ ))    (( j=1; j<=31; j++ ))            if [[ $i -le 9 && $j -le 9 ]]                    aws s3 cp $s3url/0$i/0$j/ ~/test/ --recursive         elif [[ $i -le 9 && $j -ge 10 ]]                    aws s3 cp $s3url/0$i/$j/ ~/test/ --recursive         elif [[ $i -ge 10 && $j -le 9 ]]                    aws s3 cp $s3url/$i/0$j/ ~/test/ --recursive         elif [[ $i -ge 10 && $j -ge 10 ]]                    aws s3 cp $s3url/$i/$j/ ~/test/ --recursive         fi    done done  v in `ls ~/test/` ; gunzip $v ; done  v in `ls ~/test/` ; cat ~/test/$v | grep runinstances >> ~/test/result.txt; done  grep -o 'runinstances' ~/test/result.txt | wc -l 

is there anyway can without downloading zip files , directly info s3 bucket itself? because taking lot of time having on 1 million log files.

i need way figure out programming language or script.

thanks support.

what mean directly info s3 bucket itself? s3 storage resource not compute resource. can avoid downloading disk file. instead can process in memory without saving file still have download it.

suggestions:

  • don't download trails regions entire year. take looong time
  • process 1 month data region @ time. repeat other months/regions
  • use python/boto3 has many handy features processing trail logs , extract info want

i every day (only previous day logs) can't give code.


Comments

Popular posts from this blog

mysql - Dreamhost PyCharm Django Python 3 Launching a Site -

java - Sending SMS with SMSLib and Web Services -

java - How to resolve The method toString() in the type Object is not applicable for the arguments (InputStream) -