View management operations recorded by ActionTrail
ApsaraDB for SelectDB integrates with Alibaba Cloud ActionTrail, which records management operations on your instances as queryable events. Use ActionTrail to audit operations in real time, trace issues, and deliver audit logs to Simple Log Service (SLS) Logstores or Object Storage Service (OSS) buckets for long-term storage.
Prerequisites
Before you begin, ensure that you have:
An Alibaba Cloud account that has passed real-name verification
No overdue payments on the account
ActionTrail is automatically activated — no manual setup required.
Billing
ActionTrail is free of charge.
ActionTrail will charge fees for specific features in the future. You will receive a notification at least one month before any charges apply.
If you deliver events to SLS or OSS, charges apply based on the billing rules of those services:
SLS: Billing overview
OSS: Billing overview
Limitations
Query scope:
ActionTrail can only query events delivered by single-account trails. To query events from multi-account trails, deliver those events to an SLS Logstore or OSS bucket and query them there. For details, see Create a multi-account trail.
ActionTrail tracks operations performed in the last 90 days within a region. To query events older than 90 days, create a single-account trail and deliver events to an SLS Logstore or OSS bucket. For details, see Create a single-account trail. To query events older than 90 days across multiple regions, or to use multiple filter conditions, use the advanced event query feature. For details, see Perform custom event queries.
Delays:
Events appear in ActionTrail 10 minutes after the operation is performed in ApsaraDB for SelectDB.
After an event is generated, wait 10 minutes before querying it in the ActionTrail console.
View management events
Log on to the ApsaraDB for SelectDB console.
In the top navigation bar, select the region where your instance resides.
In the left-side navigation pane, click Instances. On the Instances page, find the target instance and click its ID to go to the Instance Details page.
In the upper-right corner of the Instance Details page, click Management Operation Audit. The Event Query page in the ActionTrail console opens, listing SelectDB management operations as events.
On the Event Query page, select a query method based on your scenario.
For most use cases — such as reviewing recent operations or investigating an incident — the default Event Query page covers the last 90 days without requiring any additional setup.
| Scenario | Query method | Reference |
|---|---|---|
| Query management events from the last 90 days | Event detail queries. Each query supports one filter condition. | Query events in the ActionTrail console |
| View 2-hour interval statistics for management events from the last 90 days | Event summary queries. Each query supports one filter condition. Improves query performance for high-volume event data. | Event summary query |
| Query events older than 90 days | Advanced event queries. Supports multiple filter conditions. Requires enabling the advanced event query feature on an existing trail. Queries both management events and insight events generated in the last 90 days and more than 90 days ago. | Perform custom event queries |
| Identify unusual or exceptional operations from the last 90 days | Insights event queries. Each query supports one filter condition. Includes IPInsight events, which flag operations from unusual IP addresses to help you detect potential risks early. | Query Insights events in the ActionTrail console |