This topic describes how to query event summaries in the ActionTrail console. By default, ActionTrail records the events that occurred within your Alibaba Cloud account in the last 90 days. ActionTrail generates event summaries every 2 hours. You can query event summaries in the ActionTrail console to improve event query efficiency.

Limits

  • In the ActionTrail console, you can query the summaries of only the events delivered by single-account trails. You can perform queries at most twice per second. You cannot query the summaries of the events delivered by multi-account trails in the ActionTrail console. You can query such events in the corresponding Object Storage Service (OSS) bucket or Log Service Logstore. For more information, see Create a multi-account trail.
  • You can use the event summary query feature to query the summaries of only the events that occurred in the current region in the last 90 days.
    • To query the events that occurred in the current region 90 days ago, you must create a single-account trail to deliver the events to OSS or Log Service. Otherwise, you cannot query the events that occurred 90 days ago. For more information, see Create a single-account trail.
    • To query the events that occurred in multiple regions 90 days ago or filter and query events based on multiple conditions, you can use the advanced event query feature. For more information, see Perform advanced event queries in the ActionTrail console.
  • After an event occurs within your Alibaba Cloud account, you must wait 10 minutes before you can query the summary of the event in the ActionTrail console.

Procedure

  1. Log on to the ActionTrail console.
  2. In the left-side navigation pane, click Event Summary Query.
  3. In the top navigation bar, select the region where the event that you want to query occurred from the drop-down list.
  4. On the Event Summary Query page, set a filter condition, specify a time range for the query, and then click the Search icon.
    Note
    • You can filter summarized events by event name, service name, read/write type, or AccessKey ID.
    • You can query the summaries of global events in all regions.
  5. Find the summarized event that you want to query and click its name to view the event summary.
    Summery
  6. Optional:To view the code of the event summary, click Details.
    Note For more information about the fields in the event summary, see ActionTrail event log reference.