When an event is delivered to the Object Storage Service (OSS) bucket that you specify or create, ActionTrail generates a storage path for the event with the hierarchy specified based on the region and date information, including the year, month, and day, and places the event in the path.

  • The storage path of an event that a single-account trail delivers to an OSS bucket is in one of the following formats:
    • Management event: oss://<bucket>/<Log file name prefix>/AliyunLogs/Actiontrail/<region>/<YYYY>/<MM>/<DD>/<Log file>
    • Insight event: oss://<bucket>/<Log file name prefix>/AliyunLogs/Actiontrail-Insight/<region>/<YYYY>/<MM>/<DD>/<Log file>
      Note To store insight events, you must apply for required permissions. For more information, see Overview of insight events.
  • The storage path of an event that a multi-account trail delivers to an OSS bucket is in the following format:
    oss://<bucket>/<Log file name prefix>/AliyunLogs/Actiontrail/rd_id/accountid/regionid/yyyy/mm/dd/Log file