ActionTrail OSS storage path object key format - ActionTrail

When a trail delivers events to an OSS bucket, ActionTrail stores them as GZIP log files organized by region and date (year/month/day).

Storage paths

The object key format varies by trail type:

single-account trail

oss://<bucket name>/<log file name prefix>/AliyunLogs/<event type>/<region ID>/<YYYY>/<MM>/<DD>/Actiontrail_<region ID>_<YYYYMMDDHHMMSS>_1002_<event count>_<log file size>_<md5>.gz

multi-account trail

oss://<bucket name>/<log file name prefix>/AliyunLogs/<event type>/<rd_id>/<accountid>/<region ID>/<YYYY>/<MM>/<DD>/Actiontrail_<region ID>_<YYYYMMDDHHMMSS>_1002_<event count>_<log file size>_<md5>.gz

The following table describes each field in the object key.

Parameter	Description	Example
bucket name	The OSS bucket name specified when creating the trail. You can find the bucket name on the Trails page of the ActionTrail console.	MyBucket
log file name prefix	The log file name prefix specified when creating the trail. Note Optional. If not specified, this component is omitted from the object key.	action-logs
AliyunLogs	Fixed string indicating Alibaba Cloud event records.	AliyunLogs
event type	Valid values: Actiontrail: Represents management events. Actiontrail-Insight: Represents insight events. Note Insight events require access approval. Overview of insight events. Multi-account trails do not support insight events.	Actiontrail
rd_id	The resource directory ID that contains the management account. Applies to multi-account trails only.	rd-UG****
accountid	The ID of the account that generated the event (management account or resource directory member). Applies to multi-account trails only.	181761095690****
region ID	The region where the event was recorded.	cn-hangzhou
YYYY	Year of delivery (UTC).	2021
MM	Month of delivery (UTC).	10
DD	Day of delivery (UTC).	09
event count	The number of events in the log file.	564
log file size	The log file size, in bytes.	51310
md5	The MD5 hash of the log file.	2bdf022eef574ce180b5ebc54132e6b2

Note

Object key paths use UTC. Convert local time to UTC when querying events. For example, 07:00:00 on January 3, 2021 (UTC+8) corresponds to 23:00:00 on January 2, 2021 (UTC), so set DD to 02.
Events near midnight UTC may appear in the previous day's log file. For example, an event at 23:00:00 UTC on October 1, 2021 might be in the 2021/09/30 directory.

Examples

Example 1: Management event from a single-account trail

Management event log file from a single-account trail in China (Hangzhou), 00:05:03 UTC on October 9, 2021. Prefix: action-logs, 564 events, 51,310 bytes.
```
action-logs/AliyunLogs/Actiontrail/cn-hangzhou/2021/10/09/Actiontrail_cn-hangzhou_20211009000503_1002_564_51310_2bdf022eef574ce180b5ebc54132e6b2.gz
```
Example 2: Insight event from a single-account trail

Insight event log file from a single-account trail in China (Hangzhou), 00:05:03 UTC on October 9, 2021. Prefix: action-logs, 564 events, 51,310 bytes.
```
action-logs/AliyunLogs/Actiontrail-Insight/cn-hangzhou/2021/10/09/Actiontrail_cn-hangzhou_20211009000503_1002_564_51310_2bdf022eef574ce180b5ebc54132e6b2.gz
```
Example 3: Management event from a multi-account trail

Management event log file from a multi-account trail in China (Shanghai), 06:40:18 UTC on September 30, 2021. Account: 181761095690****, resource directory: rd-UG****. Prefix: rd-logs, 1 event, 639 bytes.
```
rd-logs/AliyunLogs/Actiontrail/rd-UG****/181761095690****/cn-shanghai/2021/09/30/Actiontrail_cn-shanghai_20210930064018_1002_1_639_378e668b76e74e6c465a082b4fb17331.gz
```