This topic describes how to query historical events in the ActionTrail console or by calling the LookupEvents operation. By default, ActionTrail allows you to query the historical events recorded in the last 90 days. You can also download these events in the ActionTrail console.

Note You can only query historical events for a single-account trail in the ActionTrail console or by calling the LookupEvents operation. The events can be queried a maximum of two times per second. You cannot query historical events for a multi-account trail in the ActionTrail console or by calling the LookupEvents operation. You can only query such historical events in the corresponding Object Storage Service (OSS) bucket or Log Service Logstore.

Query historical events in the ActionTrail console

  1. Log on to the ActionTrail console.
  2. In the top navigation bar, select the target region from the drop-down list.
  3. In the left-side navigation pane, choose ActionTrail > History Search. The historical events recorded in the last 90 days appear on the History Search page.
  4. On the page, move the pointer over the name of the target event in the Event Name column. Then, view the event details.
    Event type
  5. To query the code of an event log, click the plus sign (+) to the left of the target event record. Then, click View Event. In the dialog box that appears, view the event log.
    Note On the History Search page, you can filter events by event type, username, event name, resource type, resource name, service type, AccessKey ID, and time range. Global events can be found in the event history in all regions.

Query historical events by calling the LookupEvents operation

You can call the LookupEvents operation to query historical events recorded in the last 90 days. For more information, see LookupEvents.