All Products
Search

This Product

    ActionTrail:What do I do if the advanced event query and event alerting features of ActionTrail are unavailable?

    Document Center

    ActionTrail:What do I do if the advanced event query and event alerting features of ActionTrail are unavailable?

    Last Updated:Sep 04, 2026

    ActionTrail automatically creates a Simple Log Service (SLS) Logstore and an index when you create a trail and deliver events to SLS. If the index is manually deleted or modified, the advanced event query and event alerting features may become unavailable. To resolve this issue, restore the index settings.

    Configure an index in the console

    You can restore the index to its default configuration in the ActionTrail console.

    1. Log on to the ActionTrail console.

    2. In the left navigation pane, click Trail.

    3. On the Trails page, find the target trail. In the Storage Service column, hover over SLS or SLS&OSS and then click the name of the SLS Logstore.

    4. In the Simple Log Service console, choose Index Attributes > Properties.

    5. In the Search & Analysis panel, turn off the LogReduce switch, turn on the Full-text Index switch, and then turn on the Enable Analytics switch for the relevant fields within the event object.

    6. Click Confirm.

    7. In the Search & Analysis Settings dialog box, click Confirm.

    Use Cloud Shell to set an index

    You can also recreate the index by running a command in CloudShell.

    1. Log on to CloudShell.

    2. Run the following command to create the index.

      actiontrail-update-index [project] [logstore] [regionId]
      Note

      Replace the project, logstore, and regionId placeholders with the name of your project, the name of your Logstore, and the ID of the region where your project resides. You can find these values on the trail details page in the ActionTrail console.

      Example:

      actiontrail-update-index actiontrail-ev****  actiontrail-test**** cn-hangzhou

    Advanced query fails with "The project does not belong to you"

    When you use advanced query in the ActionTrail console, you may receive the error message "The project does not belong to you", or see a warning that no trail meets the query conditions.

    Cause

    This error indicates that you do not have permission to access the specified Simple Log Service (SLS) project. Common causes include:

    • The SLS project that you are using (for example, normandy-actiontrail-log) does not belong to your current Alibaba Cloud account.

    • You are a Resource Access Management (RAM) user and have not been granted read permissions on the SLS project.

    • You have not created a trail, so the system has not automatically created the corresponding SLS project.

    Solution

    1. Contact your Alibaba Cloud account administrator to grant you read permissions on the SLS project, such as the log:GetProject and log:GetLogStoreLogs permissions.

    2. If you have not created a trail, log on to the ActionTrail console and create a trail that delivers events to SLS. The system automatically creates an SLS project for you. For management events, the project is named in the actiontrail-logs-<Account ID>-<random suffix> format. For data events, the region-specific project is named in the actiontrail-log-<Account ID>-<Region ID> format.

    3. Confirm that you are using the correct trail log project, and not a project that belongs to a different account or region.