最新消息显示，Alibaba ESA(Edge Security Acceleration) Logs + AI Agents: Natural Language for A
Operations work revolves around logs – troubleshooting, performance tuning, security analysis, weekly and monthly reports all depend on them. Alibaba Cloud Edge Security Acceleration (ESA) provides comprehensive log collection and log delivery capabilities. Combined with Alibaba Cloud’s open-source Agent Skills, ESA logs can be directly connected to mainstream AI coding assistants like Qoder, Claude Code, Cursor, and OpenClaw – enabling log queries, statistical analysis, security reports, and routine inspections using nothing but natural language. Anyone who has done operations work knows a simple truth: without logs, operations is like navigating blindfolded. Daily operations work depends on logs across several dimensions: A sudden spike in 5xx errors, an API slowing down, users complaining about timeouts – the first step is always “check the logs.” You need to know: Without logs, you’re guessing. How many attacks did WAF block? Is a CC attack happening right now? Which IPs are malicious? What percentage of traffic is from bots? Answering these questions requires: What’s the cache hit ratio? Which resources should be cached? Is origin bandwidth growing abnormally? These require: Daily reports, weekly reports, monthly reports – operations teams need to regularly update management on: The common prerequisite for all of this: you can easily extract the data you need from massive volumes of logs. Alibaba Cloud Edge Security Acceleration (ESA) is a platform that integrates CDN acceleration, WAF protection, CC/DDoS defense, and edge computing into a single product. For operations teams, ESA’s key value is that it produces complete, structured, and deliverable logs. ESA provides two categories of core logs: A detailed record for every request, including: A detailed record for every security event, including: Traditional log analysis is slow: download logs → upload to a data warehouse → clean data → define models → query. ESA’s real-time log system cuts through this entire workflow. It uses stream processing to deliver raw logs from over 3,200 global points of presence (POPs) to your servers within seconds. ESA real-time logs offer: ESA real-time logs cover a wide range of scenarios: Creating a real-time log delivery task follows a straightforward flow: Select a log category → Select log fields → Select a destination → Configure destination details → Verify ownership ESA supports delivering real-time logs to a wide range of destinations: Each destination supports compression (gzip, zlib, snappy, lz4, zstd), custom field filters, and sampling rates to control data volume and cost. Here’s a step-by-step guide to setting up ESA real-time log delivery: For account-level logs (Edge Routine Log, Edge Container Log): For website-level logs (Access and Origin Log, Firewall Log, TCP/UDP Proxy Log, DNS Log): Configure the following parameters: Choose where to deliver logs: For SLS delivery: For OSS delivery: For S3-compatible storage: For HTTP Server: For third-party object storage (S3 / S3-compatible): ownership verification is required. The system sends a .txt token file to your bucket; you retrieve it, copy the content, and submit it back to confirm ownership. Note: Task limits are counted separately per log type. For example, on the Enterprise plan, you can create 5 tasks for Access and Origin Log AND 5 tasks for Firewall Log. For Access and Origin Logs, you can add custom fields to capture additional context: Custom fields are configured in the ESA console under Real-time Logs > Custom Fields. Once ESA real-time logs are delivered to SLS, you gain access to SLS’s powerful query and analysis capabilities: ESA provides the complete data foundation – comprehensive, structured, real-time, and queryable. The question is: how can operations teams use this data efficiently? After ESA logs are delivered to SLS, the traditional query workflow looks like this: This approach has several problems: Operations people don’t need to learn query languages – they just need answers. Alibaba Cloud’s open-source Agent Skills framework encapsulates SLS query and analysis capabilities into a standardized Skill (alibabacloud-sls-query). This Skill tells an AI Agent how to: Once this Skill is loaded, any AI coding assistant that supports the Skill/MCP protocol can query ESA logs using natural language. ┌─────────────────────────────────────────────────┐ │ Operations Engineer │ │ “Generate today’s ESA security report” │ │ “Which URLs had the worst response times?” │ │ “How many SQL injections did WAF block today?” │ └────────────────┬────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────┐ │ AI Agent Client │ │ ┌──────────┬────────────────────┬──────────┐ │ │ │ Qoder │ Claude │ Cursor │ OpenClaw │ │ │ │ │ Code │ │ │ │ │ └──────────┴──────────┴──────────┴──────────┘ │ │ ┌────────────────────┬──────────┬────────── │ │ │ Qwen Code│ Codex │ Gemini │ Copilot │ │ │ │ │ │ CLI │ │ │ │ └──────────┴──────────┴──────────┴──────────┘ │ └────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────┐ │ Alibaba Cloud Skill: alibabacloud-sls-query │ │ │ │ Step 1 → Read ESA Logstore index config │ │ Step 2 → Pick query mode (full-text/SQL/SPL) │ │ Step 3 → Construct query statement │ │ Step 4 → Resolve time range │ │ Step 5 → Execute via aliyun CLI │ │ Step 6 → Extract data, generate readable report │ └────────────────┬────────────────────────────────┘ │ ▼ ─────────────────────────────────────────────────┐ │ aliyun CLI (AI Mode) │ │ aliyun sls get-logs-v2 │ └──────────────────────────────────────────────── │ ▼ ┌─────────────────────────────────────────────────┐ │ Alibaba Cloud SLS (Log Service) │ │ (fed by ESA Real-Time Logs) │ │ │ │ ┌─────────────────── ┌──────────────────────┐ │ │ │ ESA Access Logs │ │ ESA Security Logs │ │ │ │ · Request details │ │ · WAF block records │ │ │ │ · Cache hit/miss │ │ · CC protection │ │ │ │ · Origin fetch │ │ · Bot identification │ │ │ │ · Response time │ │ · IP block records │ │ │ └───────────────────┘ └──────────────────────┘ │ └───────────────────────────────────────────────── Operations people no longer need to open the SLS console or write query syntax by hand. Ask in natural language, and the AI Agent handles querying, statistics, analysis, and report generation automatically. The CLI is the channel through which the AI Agent queries SLS logs. # One-line install /bin/bash -c “$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)” # Verify version (requires >= 3.3.8) aliyun version Step 2: Configure AK and RAM Permissions Create a user in the RAM Console and grant log read-only access. Recommended policy: Least privilege: If you only need to query logs, scope the Resource down to the specific ESA Project and Logstore rather than granting global access. Configure the CLI: aliyun configure # Follow prompts to enter AccessKey ID, AccessKey Secret, default Region Enable AI Mode: aliyun configure ai-mode enable aliyun configure ai-mode set-user-agent –user-agent “AlibabaCloud-Agent-Skills/alibabacloud-sls-query” aliyun plugin update Security note: Never paste AK/SK values into a conversation. The Skill also strictly prohibits this behavior internally. The Skill source code is open-source on GitHub: https://github.com/aliyun/alibabacloud-aiops-skills/tree/master/skills/storage/sls/alibabacloud-sls-query Loading methods vary across AI clients, but the core idea is the same – place SKILL.md and the references/ directory where your client can find it. Once loaded, the AI Agent “knows” how to query and analyze SLS logs. “Show me the overall ESA status for the past hour: total requests, status code distribution, average response time, cache hit ratio.” The AI Agent will: ESA Health Check – Past 1 Hour ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Total Requests: 48,237 Status Code Distribution: 200: 93.50% (45,102) 304: 3.83% (1,847) 301: 1.16% (562) 4xx: 1.26% (604) 5xx: 0.25% (122) ← needs attention Avg Response Time: 45ms (P99: 320ms) Cache Hit Ratio: 67.21% Spot the 0.25% 5xx rate, follow up with “show me which URLs the 5xx errors are concentrated on,” and you’ve pinpointed the issue immediately. “Generate today’s ESA security report: total WAF blocks, breakdown by attack type, CC protection events, and Top 10 attacking IPs.” The AI Agent automatically composes multiple queries spanning both access logs and security defense logs, producing a complete security report. This is exactly what operations teams need daily – no more manually querying individual metrics, taking screenshots, and compiling summaries. One sentence, one report. “In the past 30 minutes, which IPs had abnormal request frequencies? Help me identify potential CC attack sources, listing request counts and accessed URLs for each.” The Skill automatically uses SPL for frequency analysis, identifies anomalous IPs, and lists detailed information. Combined with ESA’s built-in CC protection, operations teams can quickly verify whether automatic defenses are working. “In the past hour, what were the 20 slowest URLs by average response time? Include cache hit/miss status and origin fetch time.” Quickly identify: “Generate an ESA weekly operations report including: traffic trends (daily), status code trends, WAF block trends, CC protection trends, cache hit ratio trends, and top incidents.” This is where the AI Agent shines most. The traditional approach requires: With an AI Agent: ESA’s access logs and security defense logs cover every dimension – CDN acceleration, WAF protection, CC defense, Bot management. Logs are unified and delivered to SLS with clear structure and complete fields. Without this data foundation, AI analysis has nothing to work with. The alibabacloud-sls-query Skill standardizes the entire SLS query and analysis process: This solution doesn’t lock you into any single AI tool. Any client that supports Skill loading works: Use OpenClaw or Claude Code in the terminal for quick health check
可以预见，这一趋势将在未来深刻影响IDC行业格局
如果您正在寻找优质的海外云主机，欢迎访问 www.isclouder.com 了解更多