ActionTrail:Deliver events to Alibaba Cloud services

Use cases

Without a trail, events older than 90 days are inaccessible. Create a trail to address these scenarios:

• Scenario 1: Retain events for 180 days or longer

  To meet compliance requirements such as MLPS 2.0 (180-day minimum retention), deliver events to OSS, SLS, or MaxCompute. Events are stored permanently by default. To limit retention to 180 days, adjust settings in Modify the event retention period in OSS or Modify the event retention period in SLS.

• Scenario 2: Analyze and create alerts for sensitive operations

  Deliver events to SLS and configure alerts to detect sensitive operations such as order creation or resource deletion.

• Scenario 3: Analyze events with MaxCompute

  For advanced analytics beyond SLS capabilities, deliver events to SLS and export them to MaxCompute for distributed big data processing.

• Scenario 4: Cost-effectively analyze and permanently store events

  Service costs rank SLS > MaxCompute > OSS. For cost-effective real-time analysis with permanent storage, deliver events to SLS with a limited retention period, then periodically export to MaxCompute or OSS for archival.

Scenario 1: Retain events for 180 days or longer

1. Log on to the ActionTrail console.

2. In the left navigation bar, click > Trail.

3. In the top navigation bar, select the region where you want to create the trail.

4. On the Trail page, click Create Trail.

5. On the Create Trail page, configure the parameters for the trail.

   • In the Basic Information section, configure the trail parameters.

     Parameter	Description
     Trail Name	Must be unique within your Alibaba Cloud account.
     Trail Configuration	Set All Events to All Events.

   • In the Event Delivery Settings section, select a destination service.

     • Select Delivery to Log Service, and then select Delivery to Current Account.

       • New Log Service Project: Select a Logstore Region and enter a Project Name.

       • Existing Log Service Project: Select a Logstore Region and a Project Name.

     • Select Delivery to OSS, and then select Delivery to Current Account.

       • Create a new bucket: Configure the Bucket Name, Log File Prefix, server-side encryption, and whether to enable compliance retention.

       • Select an existing bucket: Select Bucket Name.

     • Select Delivery to MaxCompute, and then select Delivery to Current Account.

       • Set the MaxCompute Region and Project Quota.

6. Click Confirm.

   After the trail is created, view events in the destination service console:

   • OSS: Click the bucket name to view events in the OSS console.

   • SLS: Click the Project or Logstore name to view events in the SLS console.

   • MaxCompute: Click the project name to view events in the MaxCompute console.

Scenario 2: Analyze and alert on sensitive operations

1. Log on to the ActionTrail console.

2. In the left navigation bar, click Trail.

3. In the top navigation bar, select the region where you want to create the trail.

4. On the Trail page, click Create Trail.

5. On the Create Trail page, configure the parameters for the trail.

   • In the Basic Information section, configure the following parameters.

     Parameter	Description
     Trail Name	Must be unique within your Alibaba Cloud account.
     Trail Configuration	Set Write to Write. Note Sensitive operations are typically Writes. Selecting only Writes reduces audit data volume and costs.

   • In the Event Delivery Settings section, select Log Service in the current account as the delivery destination.

     • New Log Service Project: Select a Logstore Region and enter a Project Name.

     • Existing Log Service Project: Select a Logstore Region and a Project Name.

6. Click Confirm.

   Click the Project or Logstore name to view event analysis in the SLS console.

7. Configure alerts in the Log Service console.

   Set up alerts.

Scenario 3: Analyze events with MaxCompute

1. Log on to the ActionTrail console.

2. In the left navigation bar, click > Trail.

3. In the top navigation bar, select the region where you want to create the trail.

4. On the Trail page, click Create Trail.

5. On the Create Trail page, configure the parameters for the trail.

   • In the Basic Information section, configure the trail parameters.

     Parameter	Description
     Trail Name	Must be unique within your Alibaba Cloud account.
     Trail Configuration	Set All Events to All Events.

   • In the Event Delivery Settings section, select Log Service in the current account as the delivery destination.

     • New Log Service Project: Select a Logstore Region and enter a Project Name.

     • Existing Log Service Project: Select a Logstore Region and a Project Name.

6. Click Confirm.

   Click the Project or Logstore name to view event analysis in the SLS console.

7. In the Log Service console, deliver the events to MaxCompute.

   Create a MaxCompute delivery job (new version).

   Note

   You can then analyze events in MaxCompute as needed.

Scenario 4: Cost-effectively analyze and permanently store events

When you select New Log Service Project, a Logstore whose name starts with actiontrail_<trail_name> is created to permanently store events. To reduce costs, set a shorter retention period in SLS (for example, 180 days) and periodically export data to MaxCompute or OSS for permanent storage.

1. Create a trail in the ActionTrail console and deliver events to Log Service (SLS).

   To create a trail, follow Create a single-account trail.

2. Modify the log retention period in the Log Service console.

   1. Log on to the Log Service console.

   2. In the Projects section, click the name of the Project that contains the events.

   3. Click the icon next to the Logstore name, and then click the icon.

   4. On the Logstore Attributes page, click Modify in the upper-right corner.

   5. Change Data Retention Period to Specified Days, enter the retention period in days, and then click Save in the upper-right corner.

3. In the Log Service console, deliver the events to MaxCompute or OSS.

   Create an OSS delivery job (new version).