Data events provide visibility into the actions performed on or within a resource. This topic describes how to create an ActionTrail trail to log data events for supported services.
Procedure
Log on to the ActionTrail console.
In the left-side navigation pane, click Trails.
From the region selector in the top navigation bar, select the region where you want to create the trail.
The region you select is the trail's home region.
On the Trails page, click Create Trail.
On the Create Trail page, configure the basic trail information, such as the Trail Name. For Trail Event Type, select Data Event.
Under Data Event Delivery Settings, select the regions where you want to log data events. ActionTrail will deliver these events to a Simple Log Service (SLS) project in each corresponding region.
Configure one or more event selectors to specify which data events you want to log.
An event selector is a set of filters that ActionTrail uses to determine which events to deliver. You can create selectors to log events for all supported services or define up to 20 custom selectors for more granular control. For each selector, you configure the following fields:
Parameter
Description
Cloud service name
The service that contains the resources you want to log data events for. For a complete list, see Supported cloud services for data events.
Read/Write Type
The type of data operations to log. Valid values:
Read
Write
All
Event Name
Specify one or more event names to log. To log all data events for the selected service and resource type, choose All.
Resource ARN
Specify the Alibaba Cloud Resource Names (ARNs) of the resources for which you want to log events. You can optionally filter events by defining one or more conditions using the
EqualorNotEqualoperators. If multiple conditions are present, they are evaluated using a logical OR, causing ActionTrail to deliver any event that meets one or more of the specified conditions.
What to do next
When you create a data event trail, ActionTrail automatically creates the necessary SLS resources to store the events. For each selected region, ActionTrail creates:
An SLS project named
actiontrail-log-<Account ID>-<Region ID>.A Logstore within that project named
actiontrail_<Trail Name>.
After the trail is created, ActionTrail begins delivering matching data events to the corresponding Logstores. You can then query and analyze these events in the SLS console.