ActionTrail monitors operations under your Alibaba Cloud account and records event logs that are generated in the last 90 days. If you want to retain or analyze event logs that are generated in the last 180 days or more, you can create trails and deliver the event logs to a specified Object Storage Service (OSS) bucket or Log Service Logstore for storage and further analysis. This topic describes how to deliver event logs to an OSS bucket or Log Service Logstore in different scenarios by using a single-account trail.

Prerequisites

  • OSS is activated. For more information, see Activate OSS.
  • Log Service is activated.

    If Log Service is not activated, log on to the Log Service console and follow the on-screen instructions to activate the service.

Scenarios

You can create a trail in the ActionTrail console to deliver event logs in the following scenarios:

  • Scenario 1: Retain event logs for 180 days or longer

    ActionTrail can record only event logs that are generated only in the last 90 days. However, MLPS 2.0 requires that event logs be retained for 180 days or longer. Therefore, you must create a trail in the ActionTrail console to deliver the event logs to storage services. The trail delivers the event logs to a specified OSS bucket or Log Service Logstore. OSS and Log Service are paid services, for which Log Service charges more for storage. We recommend that you configure the trail to deliver the event logs to an OSS bucket.

  • Scenario 2: Analyze sensitive operations and configure alert rules for the operations

    To analyze and configure alert rules for sensitive operations, such as order generation and resource deletion, you can create a trail in the ActionTrail console to deliver related event logs to a specified OSS bucket or Log Service Logstore. The event logs cannot be analyzed in OSS. We recommend that you configure the trail to deliver the event logs to a Log Service Logstore. Then, you can analyze the event logs and configure alert rules for the event logs in the Log Service console.

  • Scenario 3: Analyze event logs by using MaxCompute

    If Log Service does not meet your analysis requirements, we recommend that you use MaxCompute to analyze the event logs. You can create a trail to deliver the event logs to a specified Log Service Logstore, and configure the Logstore to deliver event logs to a specified MaxCompute table for analysis.

  • Scenario 4: Analyze and permanently store event logs in a cost-effective manner

    To analyze and permanently store event logs in a cost-effective manner, you can use OSS, Log Service, and MaxCompute together. Log Service, MaxCompute, and OSS are paid services, which are listed in descending order of price. We recommend that you process the event logs in the following manner: Create a trail in the ActionTrail console to deliver the event logs to a specified Log Service Logstore for analysis. Change the storage period of the event logs in the Log Service console. Then, configure the Log Service Logstore to periodically deliver the event logs to MaxCompute or OSS for permanent storage.

Scenario 1: Retain event logs for 180 days or longer

  1. Log on to the ActionTrail console.
  2. In the top navigation bar, select the region where you want to create a trail.
  3. In the left-side navigation pane, choose ActionTrail > Create Trail.
  4. In the Trail Basic Settings step, configure the parameters and click Next. The following table describes the parameters.
    Parameter Description
    Trail Name The name of the trail that you want to create. The name must be unique to an Alibaba Cloud account in a region.
    Target Regions The one or more regions from which the trail delivers event logs. For this example, select All Regions for Target Regions.
    Event Type The type of event logs that the trail delivers. For this example, select All for Event Type.
  5. In the Event Delivery Settings step, select Delivery to OSS, configure the parameters, and then click Next.
    • New OSS Bucket: If you select this option, configure Bucket Name, Log File Prefix, and Server Encryption.
    • Existing OSS Bucket: If you select this option, select a bucket name from the Bucket Name drop-down list and specify Log File Prefix.
  6. In the Preview and Create step, confirm the trail information and click Submit.
  7. Click View Details. On the details page of the trail, click the bucket name in the Event Delivery Settings section to go to the OSS console and view the event logs.

Scenario 2: Analyze sensitive operations and configure alert rules for the operations

  1. Log on to the ActionTrail console.
  2. In the top navigation bar, select the region where you want to create a trail.
  3. In the left-side navigation pane, choose ActionTrail > Create Trail.
  4. In the Trail Basic Settings step, configure the parameters and click Next. The following table describes the parameters.
    Parameter Description
    Trail Name The name of the trail that you want to create. The name must be unique to an Alibaba Cloud account in a region.
    Target Regions The one or more regions from which the trail delivers event logs. For this example, select All Regions for Target Regions.
    Event Type The type of event logs that the trail delivers. For this example, select Write for Event Type.
    Note Sensitive operations are often write events. To save costs, you can select Write for Event Type to reduce the size of event logs to be delivered.
  5. In the Event Delivery Settings step, select Delivery to Log Service, configure the parameters, and then click Next.
    • New Log Service Project: If you select this option, select a region from the Logstore Region drop-down list and specify Project Name.
    • Existing Log Service Project: If you select this option, select a region from the Logstore Region drop-down list and a project name from the Project Name drop-down list.
  6. In the Preview and Create step, confirm the trail information and click Submit.
  7. Click View Details. On the details page of the trail, click the name of the Log Service project or Logstore in the Event Delivery Settings section to go to the Log Service console and view the analysis results of the event logs.
  8. In the Log Service console, configure an alert rule. For more information, see Create an alert rule.

Scenario 3: Analyze event logs by using MaxCompute

  1. Log on to the ActionTrail console.
  2. In the top navigation bar, select the region where you want to create a trail.
  3. In the left-side navigation pane, choose ActionTrail > Create Trail.
  4. In the Trail Basic Settings step, configure the parameters and click Next. The following table describes the parameters.
    Parameter Description
    Trail Name The name of the trail that you want to create. The name must be unique to an Alibaba Cloud account in a region.
    Target Regions The one or more regions from which the trail delivers events. For this example, select All Regions for Target Regions.
    Event Type The type of events that the trail delivers. For this example, select All for Event Type.
  5. In the Event Delivery Settings step, select Delivery to Log Service, configure the parameters, and then click Next.
    • New Log Service Project: If you select this option, select a region from the Logstore Region drop-down list and specify Project Name.
    • Existing Log Service Project: If you select this option, select a region from the Logstore Region drop-down list and a project name from the Project Name drop-down list.
  6. In the Preview and Create step, confirm the trail information and click Submit.
  7. Click View Details. On the details page of the trail, click the name of the Log Service project or Logstore in the Event Delivery Settings section to go to the Log Service console and view the analysis results of the event logs.
  8. In the Log Service console, deliver the event logs to a MaxCompute table.
    Note After the event logs are delivered to the MaxCompute table, you can analyze the event logs.

Scenario 4: Analyze and permanently store event logs in a cost-effective manner

If you select New Log Service Project in the Event Delivery Settings step when you create a trail in the ActionTrail console, a Logstore that is prefixed with actiontrail_{trail_name} is created. By default, event logs are permanently stored in the Logstore. However, it is not cost-effective to store event logs in Log Service. We recommend that you change the storage period of event logs and configure the Logstore to periodically deliver event logs to MaxCompute or OSS for permanent storage. For example, you can change the storage period of event logs to one month or one week.

  1. Create a trail in the ActionTrail console to deliver event logs to a specified Log Service Logstore.
    For more information about how to create a trail, see Create a single-account trail.
  2. Change the storage period of the event logs in the Log Service console.
    1. Log on to the Log Service console.
    2. In the Projects section, click the name of the project that you specified when you created the trail.
    3. On the page that appears, click the 1 icon to the left of the specified Logstore and click the 2 icon.
    4. On the Logstore Attributes page, click Modify in the upper-right corner and turn off Permanent Storage.
    5. Specify Data Retention Period and click Save in the upper-right corner.
      time
  3. Configure the Logstore to periodically deliver event logs to MaxCompute or OSS.
    For more information, see Ship log data from Log Service to OSS.