ActionTrail:Overview of data events

What you can track

Besides management events, ActionTrail can capture data events. When you configure a trail for data events, you specify the data events to track by defining conditions such as the read/write type, the event name, and the Resource ARN. You also define the regions that the trail covers. ActionTrail then processes the data events that match your conditions and delivers them to the SLS projects in those regions.

How it works

After you create a trail for data events, ActionTrail processes each data event in the following stages:

• Capture — ActionTrail captures the data events of the cloud services that the trail covers.

• Filter — ActionTrail matches each captured event against the data event selectors that you defined in the trail.

• Deliver — ActionTrail delivers the matching events to the SLS project in the corresponding region.

  The following figure shows how a data event trail works.

Billing

The cost of data event tracking comes from Simple Log Service (SLS): the data events that ActionTrail delivers are stored as logs in SLS projects and are billed as data storage.

Supported regions

ActionTrail supports data event tracking in the following regions. A data event is tracked only if both the region and the cloud service support data event tracking. For the list of supported services, see the Supported cloud services section in this topic.

• China (Hangzhou)

• China (Shanghai)

• China (Nanjing - Local Region) (being decommissioned)

• China (Fuzhou - Local Region) (being decommissioned)

• China (Qingdao)

• China (Beijing)

• China (Zhangjiakou)

• China (Hohhot)

• China (Ulanqab)

• China (Shenzhen)

• China (Heyuan)

• China (Guangzhou)

• China (Chengdu)

• China (Hong Kong)

• Singapore

• Australia (Sydney)

• South Korea (Seoul)

• Malaysia (Kuala Lumpur)

• Indonesia (Jakarta)

• Japan (Tokyo)

• Philippines (Manila)

• Thailand (Bangkok)

• India (Mumbai) (being decommissioned)

• Germany (Frankfurt)

• UK (London)

• US (Silicon Valley)

• US (Virginia)

• UAE (Dubai)

• China (Wuhan - Local Region)

• Zhengzhou (China Unicom Cloud)

• Qingdao Haier-Specific Region

• Heyuan Automotive-Compliant Cloud

Supported cloud services

ActionTrail supports data event tracking for the following cloud services. Some services are subject to additional region-level or cluster-level limits, which are stated with the service.

• Object Storage Service (OSS)

  Note

  ActionTrail cannot deliver data events from OSS in Finance Cloud regions.

• Microservices Engine (MSE)

• Edge Node Service (ENS)

• Fraud Detection

• CloudMonitor

• Marketing Engine (ME)

• Enterprise Mobile Application Studio (EMAS) - Mobile Push

• Tablestore

• ApsaraMQ for AMQP

  Note

  Data event auditing is available only for specific ApsaraMQ for AMQP clusters. If you enable data events but the corresponding operation logs are not recorded, contact the ApsaraMQ for AMQP team for assistance.

• DataHub

• EventBridge

• Function Compute

• Simple Message Queue (MNS)

• ApsaraMQ for MQTT

• OpenSearch

• Drive and Photo Service (PDS)

• Simple Log Service (SLS)

• ApsaraMQ for RocketMQ 4.0

  Note

  Data event auditing is available only for specific ApsaraMQ for RocketMQ clusters. If you enable data events but the corresponding operation logs are not recorded, contact the ApsaraMQ for RocketMQ team for assistance.

• Apsara File Storage NAS (NAS)

  Note

  Data event auditing for Apsara File Storage NAS is available only in the following regions: China (Qingdao), China (Heyuan), China (Guangzhou), China (Chengdu), South Korea (Seoul), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), US (Virginia), US (Silicon Valley), UAE (Dubai), and Saudi Arabia (Riyadh). More regions will be supported.