Query events in the ActionTrail console

Limits

• In the ActionTrail console, you can query events delivered by single-account trails. However, you can perform two queries at most per second. You cannot query events delivered by multi-account trails in the ActionTrail console. You can query such events in the corresponding Object Storage Service (OSS) bucket or Log Service Logstore. For more information, see Create a multi-account trail.
• You can use the event query feature to query only the events that occurred in the last 90 days in the current region. If you need to store events for more than 90 days, you can create a single-account trail to deliver the events to OSS or Log Service. For more information, see Create a single-account trail.

Procedure

1. Log on to the ActionTrail console.
2. In the top navigation bar, select the region where the events you want to query occurred from the drop-down list.
   Note Global events can be queried in all regions.
3. In the left-side navigation pane, click Event Detail Query. On the page that appears, query and view the events that occurred in the last 90 days in the current region.
4. On the Event Detail Query page, move the pointer over the name of the event that you want to query in the Event Name column. Then, view the event details.
   

   Note On the Event Detail Query page, you can filter events by read/write type, username (RAM user), event name, resource type, resource name, service name, or AccessKey ID.
5. Optional. To view the event log, click the plus sign (+) to the left of the event that you want to query, and then click Event Detail.