Huawei Cloud LTS Log Service Management

Overview

This skill manages Huawei Cloud LTS (Log Tank Service / 云日志服务) resources through hcloud CLI. It covers the full lifecycle of log groups, log streams, indexes, transfer tasks, and alarm rules, plus log search for fault diagnosis and security event response.

Capabilities:

Prerequisites

1. hcloud CLI installed and authenticated — see references/cli-installation-guide.md
2. Huawei Cloud AK/SK configured via hcloud configure (CLI profile)
3. IAM permissions — see references/iam-policies.md for least-privilege policy
4. Region: LTS is region-specific. Use --cli-region to specify the target region (e.g., cn-north-4, ap-southeast-1)

Workflow

1. Identify target log group/stream (ListLogGroups → ListLogStreams)
2. Query or manage resources based on user intent:
   ├── Query: list/show logs, indexes, transfers, alarms
   ├── Create: create log group/stream/index/transfer/alarm
   ├── Update: modify TTL/index/transfer/alarm config
   ├── Delete: remove resources (⚠️ confirmation required)
   └── Diagnose: search logs with keywords/time range
3. Return results (query returns JSON; mutations return resource config snapshot)

Core Commands

Query — Log Groups & Streams

# List all log groups
hcloud LTS ListLogGroups --cli-region={region} --project_id={project_id}

# List log streams under a group
hcloud LTS ListLogStreams --cli-region={region} --project_id={project_id} \
  --log_group_name={log_group_name}

# Query index configuration for a log stream
hcloud LTS ListLogStreamIndex --cli-region={region} --project_id={project_id} \
  --group_id={group_id} --stream_id={stream_id}

Query — Transfer Tasks

# List all transfer tasks
hcloud LTS ListTransfers --cli-region={region} --project_id={project_id}

# Filter by transfer type (OBS/DIS/DMS)
hcloud LTS ListTransfers --cli-region={region} --project_id={project_id} \
  --log_transfer_type=OBS

Query — Alarm Rules & History

# List keyword alarm rules
hcloud LTS ListKeywordsAlarmRules --cli-region={region} --project_id={project_id}

# List SQL alarm rules
hcloud LTS ListSqlAlarmRules --cli-region={region} --project_id={project_id}

# Query active or history alarms (type: active_alert/history_alert)
# --whether_custom_field=false requires --time_range (minutes); true requires --start_time/--end_time (ms)
hcloud LTS ListActiveOrHistoryAlarms --cli-region={region} --project_id={project_id} \
  --domain_id={domain_id} --type=history_alert --whether_custom_field=false --time_range=30 --limit=10

Query — Log Search (Diagnose)

# Search logs by keyword and time range
hcloud LTS ListLogs --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} --log_stream_id={log_stream_id} \
  --start_time={start_time} --end_time={end_time} \
  --keywords="ERROR" --limit=50 --is_desc=true --highlight=true

# Get log context around a specific line (for fault diagnosis)
hcloud LTS ListLogContext --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} --log_stream_id={log_stream_id} \
  --__time__={timestamp} --line_num={line_num} \
  --backwards_size=10 --forwards_size=10

# Get log distribution histogram (for trend analysis)
hcloud LTS ListLogHistogram --cli-region={region} --project_id={project_id} \
  --group_id={group_id} --stream_id={stream_id} \
  --start_time={start_time} --end_time={end_time} \
  --key_word="ERROR" --step_interval=3600000

# Query structured logs with SQL expression (requires the log stream to have a struct config)
# Supported SQL: GROUP BY / LIKE / WHERE
hcloud LTS ListQueryStructuredLogs --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} --log_stream_id={log_stream_id} \
  --start_time={start_time} --end_time={end_time} \
  --sql_expression="select * where level like '%ERROR%'"

Create — Log Groups & Streams

# Create a log group with TTL (days)
hcloud LTS CreateLogGroup --cli-region={region} --project_id={project_id} \
  --log_group_name="my-log-group" --ttl_in_days=30

# Create a log stream under a group
hcloud LTS CreateLogStream --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} --log_stream_name="my-log-stream" --ttl_in_days=30

Create — Index

# Create full-text index for a log stream
hcloud LTS CreateLogStreamIndex --cli-region={region} --project_id={project_id} \
  --group_id={group_id} --stream_id={stream_id} --logStreamId={stream_id} \
  --fullTextIndex.enable=true --fullTextIndex.caseSensitive=false \
  --fullTextIndex.includeChinese=true --fullTextIndex.tokenizer=" "

Create — Transfer Task (to OBS)

# Create a transfer task to OBS bucket
hcloud LTS CreateTransfer --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} \
  --log_streams.1.log_stream_id={stream_id} --log_streams.1.log_stream_name={stream_name} \
  --log_transfer_info.log_transfer_type=OBS \
  --log_transfer_info.log_transfer_mode=cycle \
  --log_transfer_info.log_storage_format=RAW \
  --log_transfer_info.log_transfer_status=ENABLE \
  --log_transfer_info.log_transfer_detail.obs_bucket_name={bucket_name} \
  --log_transfer_info.log_transfer_detail.obs_period=5 \
  --log_transfer_info.log_transfer_detail.obs_period_unit=min

Create — Alarm Rules

# Create a keyword alarm rule
hcloud LTS CreateKeywordsAlarmRule --cli-region={region} --project_id={project_id} \
  --domain_id={domain_id} \
  --keywords_alarm_rule_name="error-alarm" \
  --keywords_alarm_level=Critical \
  --keywords_requests.1.log_group_id={group_id} \
  --keywords_requests.1.log_stream_id={stream_id} \
  --keywords_requests.1.keywords="ERROR" \
  --keywords_requests.1.condition=">=" --keywords_requests.1.number=1 \
  --keywords_requests.1.search_time_range=5 --keywords_requests.1.search_time_range_unit=minute \
  --frequency.type=CRON --frequency.cron_expr="0 */5 * * * *" --notification_frequency=5

# Create a SQL alarm rule (requires sql_requests.[N].search_time_range)
hcloud LTS CreateSqlAlarmRule --cli-region={region} --project_id={project_id} \
  --domain_id={domain_id} \
  --sql_alarm_rule_name="sql-error-alarm" \
  --sql_alarm_level=Major \
  --sql_requests.1.log_group_id={group_id} \
  --sql_requests.1.log_stream_id={stream_id} \
  --sql_requests.1.sql="select count(*) where level='ERROR'" \
  --sql_requests.1.search_time_range=5 --sql_requests.1.search_time_range_unit=minute \
  --condition_expression=">=1" \
  --frequency.type=CRON --frequency.cron_expr="0 */5 * * * *" --notification_frequency=5

Update — TTL & Config

# Update log group TTL (save duration)
hcloud LTS UpdateLogGroup --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} --ttl_in_days=60

# Update log stream TTL and storage
hcloud LTS UpdateLogStream --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} --log_stream_id={log_stream_id} \
  --ttl_in_days=60 --whether_log_storage=true

# Update transfer task config
hcloud LTS UpdateTransfer --cli-region={region} --project_id={project_id} \
  --log_transfer_id={transfer_id} \
  --log_transfer_info.log_storage_format=RAW \
  --log_transfer_info.log_transfer_status=ENABLE \
  --log_transfer_info.log_transfer_detail.obs_bucket_name={bucket_name} \
  --log_transfer_info.log_transfer_detail.obs_period=5 \
  --log_transfer_info.log_transfer_detail.obs_period_unit=min

# Enable/disable an alarm rule (status: RUNNING/STOPPING; type: keywords/sql)
hcloud LTS UpdateAlarmRuleStatus --cli-region={region} --project_id={project_id} \
  --alarm_rule_id={alarm_rule_id} --status=STOPPING --type=keywords

Delete — ⚠️ Requires Confirmation

CRITICAL: All Delete operations require explicit user confirmation before execution. Batch deletion of all LTS resources is prohibited. Each delete must specify a single resource ID.

# Delete a log group (⚠️ cascades all log streams under it)
hcloud LTS DeleteLogGroup --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id}

# Delete a log stream
hcloud LTS DeleteLogStream --cli-region={region} --project_id={project_id} \
  --log_group_id={log_group_id} --log_stream_id={log_stream_id}

# Delete a transfer task
hcloud LTS DeleteTransfer --cli-region={region} --project_id={project_id} \
  --log_transfer_id={transfer_id}

# Delete a keyword alarm rule
hcloud LTS DeleteKeywordsAlarmRule --cli-region={region} --project_id={project_id} \
  --keywords_alarm_rule_id={alarm_rule_id}

# Delete a SQL alarm rule
hcloud LTS DeleteSqlAlarmRule --cli-region={region} --project_id={project_id} \
  --sql_alarm_rule_id={alarm_rule_id}

Parameter Confirmation

Delete Safety Rules

1. Single resource deletion only — each Delete call must specify exactly one resource ID
2. No wildcard/batch delete — DeleteLogGroup deletes all streams under the group; always confirm the cascade impact
3. User must explicitly confirm — reply "确认" / "confirm" / "ok" before any Delete execution
4. Prohibited: deleting all log groups or all alarm rules in a single session without individual confirmation

Reference Documents

• IAM Policies — Least-privilege IAM policy for LTS
• CLI Installation Guide — hcloud CLI setup
• Verification Method — How to verify the skill
• Data Flow Diagram — Data flow through the skill
• Acceptance Criteria — Acceptance criteria
• LTS Alarm Reference — Alarm rule configuration reference

KooCLI Command Format Standard

hcloud LTS ListLogGroups --cli-region={your-region} [--key=value ...]