ActionTrail will support a new version of the event query feature from 00:00:00 on October 14, 2020. After this change, ActionTrail will no longer allow you to filter events based on multiple conditions. You can filter events based on only one condition. In addition, ActionTrail will allow you to query details and summaries of events. This change affects only your query operations on events in the ActionTrail console.

Description

  • The method used to filter events in the ActionTrail console will be updated.

    Before this change, you can filter events in the ActionTrail console based on seven conditions, including the event type, username, event name, resource type, resource name, service type, and AccessKey ID. As the amount of data increases, this filtering method has negative impacts on the query efficiency and user experience. After this change, you can filter events based on only one condition.

    select
  • Specific controls will be added to facilitate time range setting.Time
  • The description of important event information will be added, such as the event name, resource, and user.Event
  • ActionTrail will allow you to query event summaries.

    ActionTrail will generate event summaries based on the basic information of events that have occurred during a time window of 2 hours. The summary of each event includes the following information:

    • when: the time window during which the operation recorded in the event was performed. ActionTrail generates event summaries based on the basic information of events that have occurred during a time window of 2 hours. You can query events in real time.
    • who: the user who performed the operation that is recorded in the event. You can view the username, account type, account ID, and AccessKey ID of the user.
    • what: the operation that is recorded in the event, such as CreateInstance or DeleteInstance.
    • which: the resource on which the operation recorded in the event was performed.
    • where: the region where the resource is managed and the IP address from which the operation recorded in the event was performed.
    search

Impacts

This change affects only your query operations on events in the ActionTrail console.

We apologize for any inconvenience caused by this change. We will speed up the upgrade and strive to provide you with more stable and robust audit services.