This topic provides several examples of event logs related to ActionTrail.

A RAM user modifies the specified trail by using the console

{
    "apiVersion": "2015-09-28",
    "eventId": "b4e23d3c-9ba7-441e-ad25-04dd2d0a****",
    "eventName": "UpdateTrail",
    "eventSource": "actiontrail.cn-hangzhou.aliyuncs.com",
    "eventTime": "2016-01-06T03:29:15Z",
    "eventType": "ApiCall",
    "eventVersion": "1",
    "requestId": "3E2B90FE-0B7B-40FB-A9CE-5C80A3F1342F",
    "requestParameters": {
        "CreateNewBucket": "false",
        "Name": "default",
        "OssBucketName": "trail",
        "OssKeyPrefix": "",
        "Region": "cn-hangzhou",
        "RoleName": "aliyunactiontraildefaultrole",
        "StartLogging": "false"
    },
    "serviceName": "Actiontrail",
    "sourceIpAddress": "42.120.XX.XX",
    "userAgent": "AliyunConsole",
    "userIdentity": {
        "type": "ram-user",
        "principalId": "28815334868278****",
        "accountId": "4****",
        "userName": "B****",
        "sessionContext": {
            "attributes": {
                "creationDate": "2016-01-06T03:29:15Z",
                "mfaAuthenticated": "true"
            }
        }
    }
}

A RAM user modifies the specified trail by using the SDK

{
    "apiVersion": "2015-09-28",
    "eventId": "aee5874f-1478-47df-932f-0ffd1851****",
    "eventName": "UpdateTrail",
    "eventSource": "actiontrail.cn-hangzhou.aliyuncs.com",
    "eventTime": "2016-01-06T03:29:15Z",
    "eventType": "ApiCall",
    "eventVersion": "1",
    "requestId": "0D690264-0D51-4B4F-8AEE-CDEB3ABD1929",
    "requestParameters": {
        "CreateNewBucket": "false",
        "Name": "default",
        "OssBucketName": "trail",
        "OssKeyPrefix": "",
        "Region": "cn-hangzhou",
        "RoleName": "aliyunactiontraildefaultrole",
        "StartLogging": "false"
    },
    "serviceName": "Actiontrail",
    "sourceIpAddress": "42.120.XX.XX",
    "userAgent": "aliyuncli/2.0.6",
    "userIdentity": {
        "type": "ram-user",
        "principalId": "27418064654829****",
        "accountId": "4****",
        "accessKeyId": "f6IzzFZMmzNw****",
        "userName": "A****"
    }
}