This topic describes the fields of operation logs in ActionTrail.
Log field | Description |
__topic__ | The topic of a log entry. Valid value: actiontrail_event. |
owner_id | The ID of an Alibaba Cloud account. |
event | The log event in the JSON format. The content of this field varies based on the log event. |
event.eventId | The ID of an event. |
event.eventName | The name of an event. |
event.eventSource | The source of an event. |
event.eventType | The type of an event. |
event.eventVersion | The data format version of an event. Valid value: 1. |
event.acsRegion | The region where an event occurs. |
event.requestId | The ID of an API request. |
event.apiVersion | The version of the API. |
event.errorMessage | The error message of an event. |
event.serviceName | The name of the Alibaba Cloud service that is associated with an event. |
event.sourceIpAddress | The source IP address that is associated with an event. |
event.userAgent | The User-Agent HTTP header that is associated with an event. |
event.requestParameters.HostId | The ID of the host from which a request is sent. |
event.requestParameters.Name | The name of a request parameter. |
event.requestParameters.Region | The region from which a request is sent. |
event.userIdentity.accessKeyId | The AccessKey ID of an account that sends a request. |
event.userIdentity.accountId | The ID of an account that sends a request. |
event.userIdentity.principalId | The principal ID of an account that sends a request. |
event.userIdentity.type | The type of an account that sends a request. |
event.userIdentity.userName | The username of an account that sends a request. |
event.errorCode | The error code of an event. |
addionalEventData.isMFAChecked | Indicates whether multi-factor authentication (MFA) is enabled for the account that is used to log on to Simple Log Service. |
addionalEventData.loginAccount | The logon account. |