ActionTrail is a service that monitors and records the actions of your Alibaba Cloud
account. ActionTrail records these actions as events. You can create a trail to deliver
events to a specified Log Service Logstore or Object Storage Service (OSS) bucket.
Then, you can create a historical event delivery task to deliver the events that occurred
in the last 90 days to the Log Service Logstore specified for the associated trail.
This way, events can be stored for a long period. You can use the advanced event query
feature to query the events that occurred in multiple regions 90 days ago in the ActionTrail
console.
In the top navigation bar, select the region where you want to create a single-account
trail.
Note The region that you select becomes the home region of the trail that you want to create.
On the Trails page, click Create Trail.
In the Trail Basic Settings step, enter a trail name in the Trail Name field, set the Event Type parameter for management events to All Events, select Insight Event, and then click Next.
In the Event Delivery Settings step, select Delivery to Log Service, select Delivery to Current Account, and then set the parameters as required.
Parameter
Description
Logstore Region
The region where the Log Service project resides.
Project Name
The name of the Log Service project. The project name must be unique within an Alibaba
Cloud account.
If you select New Log Service Project, ActionTrail creates a project with the name that you specify and creates a Logstore
in the project.
If you select Existing Log Service Project, you must select an existing project in Log Service.
For more information about how to create a project in Log Service, see Getting Started.
Click Next.
In the Preview and Create step, confirm the trail configurations and click Submit.
Step 2: Create a historical event delivery task
A trail can deliver only the events that occur after the trail is created. Therefore,
you must create a historical event delivery task to deliver the events that occurred
in the last 90 days before your trail is created. This ensures that all the events
required for auditing are stored.
In the left-side navigation pane, click Historical Event Delivery Tasks.
In the top navigation bar, select the region where you want to create a historical
event delivery task.
Note This region must be the same as the region where the associated single-account trail
resides.
On the Historical Event Delivery Tasks page, click Create Task.
On the Create Task page, select the associated trail.
Note After you select a trail, the system automatically fills in the region from which
the trail delivers events, the region where the Log Service project resides, the name
of the Log Service project, and the information about the Log Service Logstore.
Click Confirm.
After you create a historical event delivery task, you can view the associated trail,
the scope of the historical events that can be delivered, the delivery status, the
time when the task was created, and the time when the task was completed on the Historical Event Delivery Tasks page.
Step 3: Perform advanced event queries
ActionTrail provides a variety of event query methods, such as event details query,
event summary query, and advanced event query. This section describes how to perform
advanced event queries in the ActionTrail console.
On the Trails page, click the name of the trail that you want to set as the default trail for the
advanced event query feature.
Click Enable next to Enable Advanced Features.
In the left-side navigation pane, click Advanced Event Query.
In the top navigation bar, select the region where the events for which you want to
perform advanced event queries occurred.
On the Advanced Event Query page, click the Custom Events tab, and query and view related events.
Note By default, if you do not set filter conditions, all events are queried.
Specify filter conditions.
Click Query.
Click the plus sign (+) to the left of the event you want to query to view the event
details.
Optional. Click Event Detail to view the event log.
Click Switch to the simple mode.
Specify filter conditions.
Click Query.
Click the plus sign (+) to the left of the event you want to query to view the event
details.
Optional. Click Event Detail to view the event log.
What to do next
After you create a trail to deliver events to a specified Log Service Logstore or
OSS bucket, you can query or analyze these events in the Log Service or OSS console.
For more information, see the following topics: