amazon web services - Retrieving Username from CloudTrail logs for RunInstances event -
we have large number of ec2 instances running in aws 1 year. trying perform clean activity unused instances , based on username using have launched instances.
i have tried downloading cloudtrail logs s3 bucket , tried filtering username , 'runinstances' event may find user launched instance , instance details.
the following script used download cloudtrail logs single folder, unzip them , filter instances 'runinstances' event , give count of instances.
i need on retrieving usernames each log wiht 'runinstances' event , stopping instances.
my script:
#!bin/sh s3url="s3://s3bucket/awscloudtraillogs/<accountno>/cloudtrail/region/2016/" (( i=1; i<=12; i++ )) (( j=1; j<=31; j++ )) if [[ $i -le 9 && $j -le 9 ]] aws s3 cp $s3url/0$i/0$j/ ~/test/ --recursive elif [[ $i -le 9 && $j -ge 10 ]] aws s3 cp $s3url/0$i/$j/ ~/test/ --recursive elif [[ $i -ge 10 && $j -le 9 ]] aws s3 cp $s3url/$i/0$j/ ~/test/ --recursive elif [[ $i -ge 10 && $j -ge 10 ]] aws s3 cp $s3url/$i/$j/ ~/test/ --recursive fi done done v in `ls ~/test/` ; gunzip $v ; done v in `ls ~/test/` ; cat ~/test/$v | grep runinstances >> ~/test/result.txt; done grep -o 'runinstances' ~/test/result.txt | wc -l
is there anyway can without downloading zip files , directly info s3 bucket itself? because taking lot of time having on 1 million log files.
i need way figure out programming language or script.
thanks support.
what mean directly info s3 bucket itself
? s3 storage resource not compute resource. can avoid downloading disk file. instead can process in memory without saving file still have download it.
suggestions:
- don't download trails regions entire year. take looong time
- process 1 month data region @ time. repeat other months/regions
- use python/boto3 has many handy features processing trail logs , extract info want
i every day (only previous day logs) can't give code.
Comments
Post a Comment