Operation logs record the operations of regular users, such as logons to cloud desktops as well as starting and stopping of cloud desktops. You can query the operation logs and check for exceptions.

Background information

To improve security, you can audit the operation logs of regular users. You can query operation logs for the following event types: desktop start, desktop stop, desktop session establishment, desktop session disconnection, desktop connection request, desktop restart, and AD user logon.


  1. Log on to the EDS console.
  2. In the top navigation bar, select a region.
  3. In the left-side navigation pane, click Operations Logs.
  4. Query and audit operation logs.
    By default, the operation logs for the previous day (24 hours before the current time) are displayed. Select a query type and enter the required search information, or select a time range. Then, click the Query icon.
    Each operation log includes the following information:
    • Event information: the information about an event, including the event ID, event type, occurrence time, bytes sent, bytes received, and status.
    • User information: the information about the regular user who performs the operation, including information about the Alibaba Cloud account and the logon user.
    • Desktop and client information: the information about the client and the cloud desktop, including the desktop ID, desktop IP address, directory ID, client operating system, client version, and client IP address.