If a regular user connects to a cloud desktop from an Elastic Desktop Service client, starts, and stops the cloud desktop, these operations and the operations that the user performed on the cloud desktop are logged. You can query the operation logs to check whether exceptions exist.

Background information

To improve security, you can query and audit the logs of operations performed by regular users. If regular users start, stop, and restart cloud desktops, establish and close sessions, send connection requests, and log on to cloud desktops, these operations are logged.


  1. Log on to the EDS console.
  2. In the top navigation bar, select a region.
  3. In the left-side navigation pane, choose Audit Trails > Audit Logs > User Operation Logs.
  4. Query and audit operation logs based on your business requirements.
    1. Select a time range.
      By default, the operation logs of the previous day (24 hours before the current time) are displayed. You can specify a time range to query.
    2. Select a type of logs, and select or enter the fields that you want to query.
      • If you select Event Type, select the event that you want to query.
      • If you select another query type, enter the fields that you want to query and click Figure-Query.
    Each operation log entry includes the following information:
    • Event information: the information about the operation of an event, including the event ID, event type, and occurrence time.
    • User information: the regular user (client logon user) that performs the operation.
    • Desktop information: the ID and name of the cloud desktop on which the regular user performs the operation, as well as the ID and name of the workspace to which the cloud desktop belongs.
    • Client information: the client that holds the cloud desktop, the OS that the client runs, client version, and the IP address that the client uses.
  5. Optional: To further analyze operation logs, click Export Logs. The exported logs are saved in an Excel file on your local computer.