All Products
Search

This Product

    ActionTrail:Download ActionTrail events

    Document Center

    ActionTrail:Download ActionTrail events

    Last Updated:Jun 21, 2026

    By default, ActionTrail retains events for your Alibaba Cloud account for the last 90 days. You can query these events in the ActionTrail console but cannot download them directly. If your audit requirements demand access to events older than 90 days, or if you need to download events locally for analysis, you must create a trail. A trail delivers events to Log Service (SLS) or Object Storage Service (OSS). You can then download the events as files from SLS or OSS.

    Background

    This topic uses a single-account trail as an example to explain how to download ActionTrail events from Log Service (SLS). The process involves these steps:

    1. Create a trail in the ActionTrail console to deliver events to SLS. The trail continuously collects new audit events and delivers them to the specified logstore.

    2. (Optional) Create a data backfill task in the ActionTrail console. This one-time task delivers historical audit events from the past 90 days to the logstore specified in your trail.

    3. Download events from the Log Service console. You can query for specific events and then download them from SLS using various methods.

      For example, you can run the following SQL statement to query aggregated results for all management events that are write operations.

      Note

      If you specify a long time range for your query, we recommend that you add LIMIT N to the statement to return only N events. For example, setting LIMIT 20 returns 20 events.

      * AND "event.eventCategory": Management AND "event.eventRW": Write | SELECT"event.serviceName"AS servieName,"event.eventName"AS eventName,"event.eventRw"AS eventRw,"event.sourceIpAddress"AS sourceIpAddress,"event.resourceName"AS resourceName,"event.resourceType"AS resourceType,"event.userIdentity.userName"AS userName,"event.userIdentity.type"AS userType,"event.userIdentity.accessKeyId"AS accessKeyId,"event.acsRegion"AS eventRegion,COUNT("event.eventId")AS n, date_trunc('hour', __time__) AS time GROUP BY time, servieName, eventName, eventRw, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

      In the query results, 'n' represents the count of events in each group.

    Step 1: Create a trail and deliver to SLS

    1. Log on to the ActionTrail console.

    2. In the left-side navigation pane, click Trails.

    3. In the top navigation bar, select the region for the trail.

      Note

      This region becomes the home region of the single-account trail.

    4. On the Trails page, click Create Trail.

    5. On the Create Trail page, configure the trail.

      • In the Basic Information section, set the trail name and the management event type.

        Note

        By default, the trail applies to all regions. We recommend that you set Management Event to All Events to capture all events from all regions. For more information about the parameters, see Create a single-account trail.

      • In the Event Delivery section, configure event delivery to SLS in the current account.

        Parameter

        Description

        Logstore Region

        The region of the SLS project.

        Project Name

        The name of the SLS project.

        Note

        Project names must be globally unique within Alibaba Cloud.

    6. Click Confirm.

    (Optional) Step 2: Create a data backfill task

    A trail delivers only events that are generated after it is created. If you need a complete 90-day event history, you must create a data backfill task to deliver events that occurred before the trail was created.

    Note

    To create a data backfill task, submit a ticket to obtain permissions to use the data backfill feature.

    1. In the left-side navigation pane, click Backfill.

    2. In the top navigation bar, select the region for the data backfill task.

      Note

      This region must match the home region of the trail.

    3. On the Backfill page, click Create Task.

    4. On the Create Task page, select the trail.

      Note

      After you select a trail, the system automatically populates the region, project, and Logstore fields.

    5. Click Confirm.

      After the task is created, check its Delivery Status on the Backfill page to verify event delivery.

    Step 3: Download events from the SLS console

    You can query events within a specific time range in the Log Service console and then download them. If your query returns multiple events, SLS downloads them into a single file.

    1. In the ActionTrail console, go to the logstore associated with your trail.

      1. In the left-side navigation pane, click Trails.

      2. In the top navigation bar, select the trail's home region.

      3. On the Trails page, find the target trail, hover over SLS or SLS & OSS in the Storage Service column, and then click the SLS logstore name.

    2. In the Log Service console, click 15 Minutes (Relative), and set a time range for the query, such as Today.

    3. Enter a query statement and click Search & Analyze.

      For information about how to construct a query statement, see Use SQL to query ActionTrail events in Log Service.

    4. Download the events.

      • Method 1: Download event statistics, grouped by field.

        On the Chart tab, click the 图表 icon, and then click Download Log.

      • Method 2: Download the raw event logs.

        On the Raw Logs tab, click the 下载 icon.

    5. In the Download Log dialog box, select a download method and click Confirm.

      • Download: Downloads the logs displayed on the current page to a local CSV file.

      • Download with Cloud Shell: Follow the on-screen instructions to download all logs.

        Note

        Cloud Shell is currently located in the China (Shanghai) region. If your logstore is in a different region, downloading logs incurs internet traffic charges. For more information about pricing, see Pricing.

      • Download with CLI: Follow the on-screen instructions to download all logs.

        Note

        • When you download logs using the command line tool, you must replace the AccessKey information in the command. To obtain the AccessKey pair for your Alibaba Cloud account, log on to the User Information Management console. If you use a RAM user to download the logs, log on to the RAM console to create a RAM user and get its AccessKey pair.

        • If the machine running the command line tool is in the same region as the project, click Switch to Internal Endpoint. This provides faster downloads and avoids internet traffic charges.

    Related topics

    For more information about downloading logs, see Download logs.