/alibabacloud-emas-apm-remotelog

name: alibabacloud-emas-apm-remotelog
description: |
  EMAS APM Remote Log (TLog) CLI Skill. Use for remote log retrieval, task management, and log query operations via Alibaba Cloud CLI.
  Triggers: "EMAS APM", "remote log", "tlog", "log retrieval", "log collection", "get-tlog-device-list", "create-tlog-task", "search-tlog", "mobile app log".

EMAS APM Remote Log (TLog) CLI Skill

Scenario Description

This skill enables remote log retrieval (TLog) operations for mobile applications managed by Alibaba Cloud EMAS APM (Application Performance Monitoring). It provides a complete workflow to:

1. **Resolve target devices** by device ID, user nickname, user ID, or custom ID 2. **Create remote log retrieval tasks** to trigger log collection from end-user devices 3. **Track task progress** including overall task status and per-device collection status 4. **Query log details** by device and time window with level and keyword filtering 5. **Query actively submitted logs** for user-initiated log uploads

**Architecture**: EMAS Console + Mobile App (with TLog SDK) + EMAS APM Service + Alibaba Cloud CLI (`emas-appmonitor` plugin)

**Key Components**:

• **Device Side**: Mobile apps integrated with EMAS TLog SDK (Android/iOS)
• **Server Side**: EMAS APM backend service for task dispatch and log storage
• **Client Side**: Alibaba Cloud CLI with `aliyun-cli-emas-appmonitor` plugin for API operations

Installation

**Pre-check: Alibaba Cloud CLI >= 3.3.3 required**

aliyun version
# If not installed or version too low (script served by Alibaba Cloud official CDN over HTTPS):
curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash
aliyun version

> **Security note** — the one-liner above pipes a remote script directly into `bash`. The script is hosted on Alibaba Cloud's official CDN (`aliyuncli.alicdn.com`) and served over HTTPS, so transit is authenticated. However, if your environment requires inspecting installer scripts before execution (security-hardened CI, regulated workloads, multi-tenant hosts), use the safer two-step flow in [references/cli-installation-guide.md](references/cli-installation-guide.md#safer-installation-flow) — download → inspect → execute. Do **not** run this command with elevated privileges (e.g. as root); the installer does not require it.

**Pre-check: Alibaba Cloud CLI plugin update required**

aliyun configure set --auto-plugin-install true
aliyun plugin update

**Install EMAS APM Plugin**

aliyun plugin install --names aliyun-cli-emas-appmonitor
aliyun plugin list | grep emas-appmonitor  # Verify version >= 0.3.1

> For detailed installation instructions, see [references/cli-installation-guide.md](references/cli-installation-guide.md)

AI-Mode Lifecycle Management

> **[MUST] AI-Mode** — AI-mode is required for Agent Skill execution. > Run the following commands before any CLI invocation: > ```bash > aliyun configure ai-mode enable > aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-emas-apm-remotelog" > ``` > **[MUST] Disable AI-Mode at EVERY exit point** — Before delivering the final response for ANY reason, always disable AI-mode first. > ```bash > aliyun configure ai-mode disable > ```

Credential Verification

> **Pre-check: Alibaba Cloud Credentials Required** > > **Security Rules:** > - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN) > - **NEVER** ask the user to input AK/SK directly in the conversation or command line > - **NEVER** use `aliyun configure set` with literal credential values > - **ONLY** use `aliyun configure list` to check credential status > > ```bash > aliyun configure list > ``` > Check the output for a valid profile (AK, STS, or OAuth identity). > > **If no valid profile exists, STOP here.** > 1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak) > 2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile) > 3. Return and re-run after `aliyun configure list` shows a valid profile > > **Data Safety**: Do not save real AccessKeys in command-line parameters, scripts, or logs. Authentication is fully delegated to CLI profiles.

RAM Policy

> **Required Permissions**: See [references/ram-policies.md](references/ram-policies.md) for the complete list of RAM permissions required by each API. > > **Quick Reference**: > > | Permission | API | > |------------|-----| > | `apm:GetTlogDeviceList` | Query available devices | > | `apm:GetTlogDeviceInfo` | Get device details | > | `apm:CreateTlogTask` | Create log retrieval task | > | `apm:GetTlogTaskInfo` | Query task status | > | `apm:GetTlogTaskCollections` | Query device collection status | > | `apm:SearchTlog` | Query log details | > | `apm:GetTlogCollectList` | Query active submission records | > > **System Policies**: `AliyunEMASFullAccess` or `AliyunEMASReadOnlyAccess` > > **[MUST] Permission Failure Handling:** When any command or API call fails due to permission errors at any point during execution, follow this process: > 1. Read `references/ram-policies.md` to get the full list of permissions required by this SKILL > 2. Use `ram-permission-diagnose` skill to guide the user through requesting the necessary permissions > 3. Pause and wait until the user confirms that the required permissions have been granted

Parameters Requiring User Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call, > ALL user-customizable parameters (e.g., AppKey, OS type, device identifiers, > task names, time windows, etc.) MUST be confirmed with the user. Do NOT assume or use > default values without explicit user approval. > > **[MUST] RegionId is fixed** — EMAS APM service is ONLY available in `cn-shanghai`. > Always pass `--region cn-shanghai` regardless of the credential's defa