By default, ActionTrail records the events that occurred within your Alibaba Cloud account in the last 90 days. You can only query these events but cannot download them in the ActionTrail console. If you want to retain events for a longer period of time such as more than 180 days, you must create a trail to deliver events to a Log Service Logstore or an Object Storage Service (OSS) bucket. If you want to download events for analysis, you must first create a trail to deliver events to a Log Service Logstore or an OSS bucket. Then, you can download the events to a local device as files.

Background information

This topic describes how to download the ActionTrail events that are delivered by a single-account trail in the Log Service console.
  1. Create a trail in the ActionTrail console to continuously deliver events to a Log Service Logstore.
  2. Optional. Create a historical event delivery task in the ActionTrail console. The task is used to deliver the events that were recorded by ActionTrail in the last 90 days to the Log Service Logstore specified for the trail.
  3. Download ActionTrail events in the Log Service console. Multiple methods are provided for you to download the ActionTrail events that are delivered to a Log Service Logstore.

Step 1: Create a trail to deliver events to a Log Service Logstore

  1. Log on to the ActionTrail console.
  2. In the left-side navigation pane, click Trails.
  3. In the top navigation bar, select the region where you want to create a single-account trail.
    Note The region that you select becomes the home region of the trail that you want to create.
  4. On the Trails page, click Create Trail.
  5. In the Trail Basic Settings step, enter a trail name in the Trail Name field, set the Applied Regions parameter to All Regions and the Event Type parameter to All, and then click Next.
  6. In the Event Delivery Settings step, select Delivery to Log Service, select Delivery to Current Account, and then set the parameters as required.
    Parameter Description
    Logstore Region The region where the Log Service project resides.
    Project Name The name of the Log Service project. The name must be unique to an Alibaba Cloud account in a region.
    • If you select New Log Service Project, ActionTrail creates a project with the name that you specify and creates a Logstore in the project.
    • If you select Existing Log Service Project, you must select an existing project in Log Service.

      For more information about how to create a project in Log Service, see Quick Start.

  7. Click Next.
  8. In the Preview and Create step, confirm the trail information and click Submit.

Step 2: Create a historical event delivery task (Optional)

A trail can deliver only the events that occur after the trail is created. If you want to deliver the events that occurred in the last 90 days before your trail is created, you must create a historical event delivery task.

Note To obtain the permissions to create a historical event delivery task, submit a ticket.
  1. Log on to the ActionTrail console.
  2. In the left-side navigation pane, click Historical Event Delivery Tasks.
  3. In the top navigation bar, select the region where you want to create a historical event delivery task.
    Note This region must be the same as the region where the created single-account trail resides.
  4. On the Historical Event Delivery Tasks page, click Create Task.
  5. On the Create Task page, select the created single-account trail.
    Note After you select a trail, the system automatically fills in the region from which the trail delivers events, the region where the Log Service project resides, the name of the Log Service project, and the information about the Log Service Logstore.
  6. Click Confirm.

Step 3: Download ActionTrail events in the Log Service console

You can query ActionTrail events that occurred within a specified time range in the Log Service console and download the events. If multiple events are returned for a query, you can download these events to the same file for subsequent use.

  1. Log on to the ActionTrail console. Go to the Log Service Logstore to which the trail delivers events.
    1. In the left-side navigation pane, click Trails.
    2. In the top navigation bar, select the region where your single-account trail and historical event delivery task are created.
    3. On the Trails page, find the trail that you created, move the pointer over the more icon in the Storage Service column, and then click the name of the Log Service Logstore.
  2. In the Log Service console, click 15 Minutes(Relative) in the upper-right corner. In the time picker that appears, specify a time range to query. For example, you can select Today on the Relative tab.
  3. Click the Download icon to download the events returned for the query.
  4. In the Log Download dialog box, select a method to download events and click OK.
    • Download Log in Current Page: Download events as a file in the comma-separated values (CSV) format.
    • Download All Logs with Cloud Shell: Download events as prompted.
      Note The Cloud Shell server is located in the China (Shanghai) region. If you download events from a Log Service Logstore that does not reside in the China (Shanghai) region, you are charged for data transfer. For more information about pricing, see Log Service Pricing.
    • Download All Logs Using Command Line Tool: Download events as prompted.
      Note
      • If you want to download events by using a command line tool, you must modify the AccessKey ID and AccessKey secret in the command based on your AccessKey pair. If you use an Alibaba Cloud account to download events, you can obtain the AccessKey pair of the Alibaba Cloud account in the User Management console. You can also download events as a RAM user. To do so, create a RAM user. Then, create an AccessKey pair for the RAM user in the RAM console.
      • If the host on which the Log Service command line tool is installed resides in the same region as the current Log Service project, we recommend that you click Switch to Internal Endpoint. The internal network provides a higher download speed, and you are not charged for the download.