This topic describes how to query historical events in the ActionTrail console or by calling the LookupEvents operation. By default, ActionTrail allows you to query the historical events recorded in the last 90 days. You can also download these events in the ActionTrail console.

Note You can only query historical events for a single-account trail in the ActionTrail console or by calling the LookupEvents operation. The events can be queried a maximum of two times per second. You cannot query historical events for a multi-account trail in the ActionTrail console or by calling the LookupEvents operation. You can only query such historical events in the corresponding Object Storage Service (OSS) bucket or Log Service Logstore.

Query historical events in the ActionTrail console

  1. Log on to the ActionTrail console.
  2. In the left-side navigation pane, choose ActionTrail > History Search. On the page that appears, you can view the historical events recorded in the last 90 days.
  3. Click the plus sign next to an event record. The detailed information about the event appears.
  4. Click View Event. In the dialog box that appears, you can view the code of the event.
  5. Click Advanced Search. In the section that appears, specify the filter criteria to filter events.
    History search
    Note You can filter events by username, event name, resource type, resource name, product type, AccessKey, and time range. Global events can be found in the event history in all regions.

Query historical events by calling the LookupEvents operation

You can call the LookupEvents operation to query the historical events recorded in the last 90 days. For more information about the LookupEvents operation, see LookupEvents.