ActionTrail is about to support tracking and recording events of purchasing, changing the specifications of, and renewing Server Load Balancer (SLB) instances occurred in the SLB console. Previously, ActionTrail tracks and records only sales-related events of Alibaba Cloud services triggered through API operations but not those occurred in the Alibaba Cloud console. This release will support tracking and recording such events for SLB. More services will be supported in the future.

In this release, events of purchasing, changing the specifications of, and renewing SLB instances occurred in the console are supported, expanding the range of events that ActionTrail can track and record. This release also fixes the issue where user information is not included in event logs.

The eventType field, which indicates the type of the event, is set to ConsoleOperation for all events that are newly supported in this release. The settings of other fields for these events are listed as follows:
  • Event of purchasing an SLB instance: "serviceName"="Slb" and "eventName"="Create"
  • Event of changing the specification of an SLB instance: "serviceName"="Slb" and "eventName"="Modify"
  • Event of renewing an SLB instance: "serviceName"="Slb" and "eventName"="Renew"

Impacts

From the day on which this announcement is released to 23:59:59 on May 31, 2020, ActionTrail will supplement the preceding types of events that occurred before. The supplemented events with eventType set to ConsoleOperation are in parallel with the previously supported events. The following table lists the differences between the field settings for the newly supported and previously supported events.
Note We recommend that you gradually add more listeners to listen for these new types of events before 23:59:59 on May 31, 2020.
Field Value or content for original events Value or content for new events
eventName CreateLoadBalancer and ModifyLoadBalancerInternetSpec Create, Modify, and Renew
eventType ApiCall ConsoleOperation
userIdentity N/A User information
eventSource slb-pop.aliyuncs.com slb.aliyuncs.com
userAgent Java/1.8.0_152 AliyunConsole
apiVersion 2014-05-15 N/A
After 23:59:59 on May 31, 2020, you must pay attention to SLB events triggered through both the console and API operations. For these events, the serviceName field is set to Slb. The following lists the differences between the settings of the eventName field for events triggered through the console and those triggered through API operations in different scenarios:
  • Purchasing an SLB instance: "eventName":="Create" for events triggered through the console and "eventName":="CreateLoadBalancer" for events triggered through the API operation
  • Changing the specification of an SLB instance: "eventName":="Modify" for events triggered through the console and "eventName":="ModifyLoadBalancerInternetSpec" for events triggered through the API operation
  • Renewing an SLB instance: "eventName":="Renew" for events triggered through the console and "eventName":="CreateLoadBalancer" for events triggered through the API operation

We apologize for any changes to the audit data and thank you for your understanding and support. All of these are for the construction of a more objective, accurate, and comprehensive audit system.

Announced by: Alibaba Cloud ActionTrail team

Announced on: March 6, 2020

Example of an event log for purchasing an SLB instance in the SLB console

{
  "eventId": "1a22a4db-36b0-4738-822d-b200b84f****",
  "requestId": "1a22a4db-36b0-4738-822d-b200b84f****",
  "eventVersion": "1",
  "eventTime": "2020-02-23T07:27:49Z",
  "userAgent": "AliyunConsole",
  "eventSource":"slb.aliyuncs.com",
  "requestParameters": {
    "secureTransport": true,
    "mFAPresent": false,
    "sourceIp": "42. ***.74.109",
    "regionId": "cn-hangzhou-dg-a01",
    "stsTokenPlayerUid": "****809276714915"
  },
  "eventName": "Create",
  "sourceIpAddress": "42. ***.74.109",
  "acsRegion": "cn-hangzhou",
  "referencedResources": {
    "LoadBalancer": [
      "lb-bp15t2g9omw99scxa****"
    ]
  },
  "userIdentity": {
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false"
      }
    },
    "accessKeyId": "STS.NSmajggZdKxAYnzNx6ujC****",
    "accountId": "****809276714915",
    "principalId": "****53686294945515:yx",
    "userName": "CommonBuyAdminRole:yx_sub_acc****",
    "type": "assumed-role"
  },
  "eventType": "ConsoleOperation",
  "serviceName": "Slb",
  "__expanded": true
}