Elastic Container Instance:Query the creation and deletion information of elastic container instances in ActionTrail

Background information

ActionTrail is a service that monitors and records the operations of your Alibaba Cloud account. This service can be used in scenarios such as security analysis, resource change tracking, and compliance audits. For more information, see What is ActionTrail?

Procedure

1. Log on to the ActionTrail console.

2. In the left-side navigation pane, choose Events > Event Query.

3. In the top navigation bar, select a region.

4. Set query criteria to query operation events.

   For example, if you want to know the time when an elastic container instance is created and deleted, you can set the following query criteria and query all the operation events about the instance.

   1. Select Resource Name as the query type and then enter the ID of the elastic container instance that you want to query.

      Note

      You can obtain the ID of the instance on the Container Group page in the Elastic Container Instance console. If you do not know the ID of an elastic container instance that has been deleted, you can select Event Name for the Read/Write type parameter and enter DeleteContainerGroup in the search box on the Event Detail Query page. In the Resource Name column of the query results, you can obtain the ID of the elastic container instance.

   2. Set a query time range based on the time period during which the elastic container instance exists.

      Note

      By default, ActionTrail records only the operation events that are generated within the last 90 days. To query operation events that are recorded beyond this period, you can use the advanced event query feature. For more information, see Enable the advanced event query feature.

   

5. View the information about an event.

   Take note of the following items:

   • By default, the following information is displayed for each event:

     • Event Time: the time when the operation was performed.

     • Operator: the subject who initiates the operation. The operator can be an Alibaba Cloud account, a RAM user, or an Alibaba Cloud service.

     • Service Name: the name of the Alibaba Cloud service.

     • Event Name: the behavior that corresponds to the event. Examples: CreateContainerGroup and DeleteContainerGroup.

     • Related Resource: the information about the resource that was operated on.

   • Click View Event Details in the Actions column corresponding to the instance. You can view more information about the event, including the event source, error code, API request ID, and event record.

   Note

   For more information about event fields, see Management event structure.