All Products
Search

This Product

    ActionTrail:Use ActionTrail to monitor the use of an Alibaba Cloud account

    Document Center

    ActionTrail:Use ActionTrail to monitor the use of an Alibaba Cloud account

    Last Updated:Sep 08, 2026

    The Alibaba Cloud account is the owner of Alibaba Cloud resources. If the Alibaba Cloud account is disclosed, your resources are at risk. You can create a trail in the ActionTrail console to deliver events to Simple Log Service. Then, you can configure alert rules to monitor the use of your Alibaba Cloud account.

    Prerequisites

    Simple Log Service is activated.

    If you are using Simple Log Service for the first time, log on to the Simple Log Service console and follow the on-screen instructions to activate the service.

    Step 1: Create a trail

    The following example uses a single-account trail to create a trail and deliver events to Simple Log Service (SLS).

    1. Log on to the ActionTrail console.

    2. In the left-side navigation pane, click trails.

    3. In the top navigation bar, select the region where you want to create a single-account trail.

      Note

      This region becomes the home region for the single-account trail.

    4. On the trails page, click Create Trail.

    5. On the Create Trail page, set the trail parameters.

      • In the Basic Information section, configure the following parameters:

        Parameter

        Description

        Trail Name

        The name of the trail. The name must be unique within your Alibaba Cloud account.

        Trail Event Type

        By default, Management Event is selected.

      • In the Management Event Delivery Settings section, configure the following parameters.

        • Set Read/Write Type to All Events.

        • Select Delivery to Log Service.

        • Set Destination Account to Delivery to Current Account.

        • Set Project to New Log Service Project. Then, select a Logstore Region and enter a Project Name.

    6. Click Confirm.

    Step 2: Query events and configure an alert rule

    1. In the ActionTrail console, click trails.

    2. Find your trail. In the Storage Service column, hover over SLS or SLS&OSS and click the Logstore name.

    3. In the upper-right corner of the page, click Last 15 Minutes to set a time range for your query.

    4. In the search box, enter the following query statement: event.userIdentity.type:"root-account"| select count(1) as use_root. Then, click Search & Analyze.

    5. Save the query as a Save as Saved Search or an Save as Alert.

      • Save as Saved Search: Click the image.png icon in the upper-right corner, enter a Saved Query Name, and then click Confirm.

        Note

        After you save the query, you can select it in the Simple Log Service console to initiate the query.

        For more information, see Saved search.

      • Save as Alert: Click the image.png icon in the upper-right corner. In the Alert Monitoring Rule panel, configure the parameters and click Confirm.

        For more information about how to configure alert rules, see Configure an alert rule.

        Note

        After you save the query as an alert, you will receive alert notifications when the trigger condition is met.

    Results

    You can manage saved searches and alerts in the Simple Log Service console.

    In the left-side navigation pane, expand Resources and click Saved search to manage your saved searches, or click the Alerts icon to manage your alerts.

    References

    • After you deliver events to Simple Log Service, you can use other methods to configure alert rules in the Simple Log Service console. This allows you to implement monitoring and alerting for your Alibaba Cloud account. For more information, see Configure an alert monitoring rule in Simple Log Service.

    • After you deliver events to Simple Log Service, you can configure alert rules in the ActionTrail console. For more information, see Enable and configure alerts.