Elastic Container Instance:Query instance events using ActionTrail

Background

ActionTrail records operations on your Alibaba Cloud resources for security analysis, resource change tracking, and compliance auditing. What is ActionTrail?.

Procedure

1. Log on to the ActionTrail console.

2. In the navigation pane on the left, choose Events > Event Query.

3. In the top navigation bar, select a region.

4. Set the query criteria.

   For example, to find when an ECI instance was created or deleted, query all events for that instance with the following criteria.

   1. Set the query type to Resource Name and enter the ECI instance ID.

      Note

      Find the instance ID on the Container Group page in the Elastic Container Instance console. If the instance was deleted and you do not know its ID, search by Resource Name for the DeleteContainerGroup event, then locate the instance ID in the Resource Name column.

   2. Set a time range covering the period when the ECI instance existed.

      Note

      Event Query covers the last 90 days. For older events, use Advanced event query.

5. View event information.

   Each event includes:

   • The event list displays by default:

     • Event Time: The time when the operation occurred.

     • Operator: The entity that initiated the operation, such as an Alibaba Cloud account, RAM user, or Alibaba Cloud service.

     • Service Name: The name of the Alibaba Cloud service.

     • Event Name: The corresponding action. For example, CreateContainerGroup indicates that an ECI instance was created, and DeleteContainerGroup indicates that an ECI instance was deleted.

     • Related Resource: Information about the affected resource.

   • Click View Event Details to view more information, including the event source, error code, API request ID, and event record.

   Note

   Event fields are documented in Management event structure.