By default, ActionTrail records the events that occurred within your Alibaba Cloud account in the last 90 days. You can query these events but cannot download them in the ActionTrail console. If you want to retain events for a longer period of time such as more than 180 days, you must create a trail to deliver events to a Log Service Logstore or an Object Storage Service (OSS) bucket. If you want to download events for analysis, you must first create a trail to deliver events to a Log Service Logstore or an OSS bucket. Then, you can download the events to a local device as files.

Prerequisites

The permissions to manage insight events are granted to you after you request the permissions by submitting a ticket.

Background information

This topic describes how to download the ActionTrail events that are delivered by a single-account trail in the Log Service console.
  1. Create a trail in the ActionTrail console to continuously deliver events to a Log Service Logstore.
  2. Optional. Create a historical event delivery task in the ActionTrail console. The task is used to deliver the events that were recorded by ActionTrail in the last 90 days to the Log Service Logstore specified for the trail.
  3. Download ActionTrail events in the Log Service console. You can query specific events in the Log Service console and then download the events. Multiple methods are provided for you to download the ActionTrail events that are delivered to a Log Service Logstore.

    For example, you can execute the following SQL statements to count the number of times each management event of the write type occurs.

    Note If you specify a wide time range for the query, we recommend that you set the LIMIT field to an appropriate number N. This indicates that N events will be returned. For example, the setting LIMIT 20 indicates that 20 events will be returned.

    * AND "event.eventCategory": Management AND "event.eventRW": Write | SELECT"event.serviceName"AS servieName,"event.eventName"AS eventName,"event.eventRw"AS eventRw,"event.sourceIpAddress"AS sourceIpAddress,"event.resourceName"AS resourceName,"event.resourceType"AS resourceType,"event.userIdentity.userName"AS userName,"event.userIdentity.type"AS userType,"event.userIdentity.accessKeyId"AS accessKeyId,"event.acsRegion"AS eventRegion,COUNT("event.eventId")AS n, date_trunc('hour', __time__) AS time GROUP BY time, servieName, eventName, eventRw, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

    The following figure shows the query results. Each value in the n column indicates the number of times the corresponding event occurs.

    Download

Step 1: Create a trail to deliver events to a Log Service Logstore

  1. Log on to the ActionTrail console.
  2. In the left-side navigation pane, click Trails.
  3. In the top navigation bar, select the region where you want to create a single-account trail.
    Note The region that you select becomes the home region of the trail that you want to create.
  4. On the Trails page, click Create Trail.
  5. In the Trail Basic Settings step, enter a trail name in the Trail Name field, set the Event Type parameter for management events to All Events, select Insight Event, and then click Next.
  6. In the Event Delivery Settings step, select Delivery to Log Service, select Delivery to Current Account, and then set the parameters as required.
    Parameter Description
    Logstore Region The region where the Log Service project resides.
    Project Name The name of the Log Service project. The project name must be unique within an Alibaba Cloud account.
    • If you select New Log Service Project, ActionTrail creates a project with the name that you specify and creates a Logstore in the project.
    • If you select Existing Log Service Project, you must select an existing project in Log Service.

      For more information about how to create a project in Log Service, see Getting Started.

  7. Click Next.
  8. In the Preview and Create step, confirm the trail configurations and click Submit.

Step 2: Create a historical event delivery task (Optional)

A trail can deliver only the events that occur after the trail is created. If you want to deliver the events that occurred in the last 90 days before your trail is created, you must create a historical event delivery task.

Note To obtain the permissions to create a historical event delivery task, submit a ticket.
  1. In the left-side navigation pane, click Historical Event Delivery Tasks.
  2. In the top navigation bar, select the region where you want to create a historical event delivery task.
    Note This region must be the same as the region where the created single-account trail resides.
  3. On the Historical Event Delivery Tasks page, click Create Task.
  4. On the Create Task page, select the associated trail.
    Note After you select a trail, the system automatically fills in the region from which the trail delivers events, the region where the Log Service project resides, the name of the Log Service project, and the information about the Log Service Logstore.
  5. Click Confirm.

Step 3: Download ActionTrail events in the Log Service console

You can query ActionTrail events that occurred within a specified time range in the Log Service console and download the events. If multiple events are returned for a query, you can download these events to the same file for subsequent use.

  1. Log on to the ActionTrail console. Go to the Log Service Logstore to which the trail delivers events.
    1. In the left-side navigation pane, click Trails.
    2. In the top navigation bar, select the region where your single-account trail and historical event delivery task are created.
    3. On the Trails page, find the trail that you created, move the pointer over the more icon in the Storage Service column, and then click the name of the Log Service Logstore.
  2. In the Log Service console, click 15 Minutes(Relative) in the upper-right corner. In the time picker that appears, specify a time range to query. For example, you can select Today on the Relative tab.
  3. Enter an SQL statement and click Search & Analyze.
  4. Specify a form for the retrieved events.
    • Form 1: Display the events by field.

      On the Graph tab, click the table icon, and then click Download Log.

    • Form 2: Display the events in the form of raw logs.

      In the upper-right corner of the Raw Logs tab, click the Download icon.

  5. In the Log Download dialog box, select a method to download events and click OK.
    • Download Log in Current Page: Download events as a file in the comma-separated values (CSV) format.
    • Download All Logs with Cloud Shell: Download events as prompted.
      Note The Cloud Shell server is located in the China (Shanghai) region. If you download events from a Log Service Logstore that does not reside in the China (Shanghai) region, you are charged for data transfer. For more information about pricing, see Log Service Pricing.
    • Download All Logs Using Command Line Tool: Download events as prompted.
      Note
      • If you want to download events by using a command line tool, you must modify the AccessKey ID and AccessKey secret in the command based on your AccessKey pair. If you use an Alibaba Cloud account to download events, you can obtain the AccessKey pair of the Alibaba Cloud account in the User Management console. You can also download events as a RAM user. To do so, create a RAM user. Then, create an AccessKey pair for the RAM user in the RAM console.
      • If the host on which the Log Service command line tool is installed resides in the same region as the current Log Service project, we recommend that you click Switch to Internal Endpoint. The internal network provides a higher download speed, and you are not charged for the download.