This topic describes the fields of the Inner-ActionTrail feature.

The following table describes the fields used for the Inner-ActionTrail feature.
Field Description
EventID The unique ID of a log event.
EventVersion The version of an event. The current version is 1.0.0.
EventLocation The location where an operation is performed by an Alibaba Cloud employee or system. ISO 3166-1 alpha 2 country codes are used.
EventProduct The name of the product in which an operation is performed, for example, OSS.
EventName The name of the event corresponding to an API operation used by a cloud product, for example, Set Bucket Quota Limit.
EventDescription The reason for which an operation is performed. The reason may include the ticket ID, internal O&M or change ticket ID, and security scanning ID.
EventType The type of an operation.
  • CUSTOMER_INITIATED_SUPPORT

    Technical support initiated by Alibaba Cloud O&M personnel, for example, troubleshooting based on tickets submitted by customers.

  • ALIYUN_INITIATED_SERVICE

    Services initiated by Alibaba Cloud employees or systems according to O&M requirements, for example, bucket migration across clusters after the cluster hardware is out of warranty.

  • ALIYUN_INITIATED_PENALTY

    Operations performed on public user data by Alibaba Cloud employees or systems according to applicable laws and regulations.

EventMethod The method by which an operation is performed. Methods can be common read/write operations, read/write operations through internal interfaces, and other operations such as backup and recovery. For example, Internal Write.
ResourceType The resource type of an event, for example, Acs::Oss::Bucket.
ResourceID The ID of a resource, for example, $bucketID.
ResourceRegionID The ID of the region to which an event resource belongs. This field only applies to products that belong to a region, for example, cn-hangzhou.
ResourceOwnerID The ID of the account to which a resource belongs.
EventAdditionalDetail The additional information about an event.
EventTime The time (in UTC) when an operation is performed, for example, 2019-09-18T05:23:37Z.
EventLevel The severity level of an operation.
  • NOTICE: When a NOTICE-level operation is performed, it is recorded in the corresponding log.
  • WARNING: When a WARNING-level operation is performed, it is recorded in a log and the customer is alerted.