By default, ActionTrail records the events that occurred within your Alibaba Cloud account in the last 90 days. This topic describes how to query events in the ActionTrail console.
Limits
- In the ActionTrail console, you can query only the events delivered by single-account trails. You can perform queries at most twice per second. You cannot query the events delivered by multi-account trails in the ActionTrail console. You can query such events in the corresponding Object Storage Service (OSS) bucket or Log Service Logstore. For more information, see Create a multi-account trail.
- You can use the event query feature to query only the events that occurred in the current region in the last 90 days.
- To query the events that occurred in the current region 90 days ago, you must create a single-account trail to deliver the events to OSS or Log Service. Otherwise, you cannot query the events that occurred 90 days ago. For more information, see Create a single-account trail.
- To query the events that occurred in multiple regions 90 days ago or filter and query events based on multiple conditions, you can use the advanced event query feature. For more information, see Perform advanced event queries in the ActionTrail console.
- After an event occurs within your Alibaba Cloud account, you must wait 10 minutes before you can query the event in the ActionTrail console.
Procedure
- On the Event Detail Query page, set a filter condition, specify a time range for the query, and then click the
icon.
Note- On the Event Detail Query page, you can filter events by read/write type, username (RAM user), event name, resource type, resource name, service name, or AccessKey ID.
- You can query global events in all regions.
- Move the pointer over the name of the event that you want to query in the Event Name column. Then, view the event details.
