All Products
Search

This Product

    Simple Log Service:ActionTrail events

    Document Center

    Simple Log Service:ActionTrail events

    Last Updated:Jun 15, 2026

    Alibaba Cloud ActionTrail integrates with Simple Log Service to deliver operation events as logs in real time. Simple Log Service provides real-time queries, visual analytics, alerting, data shipping, and data transformation to help you monitor operations on your cloud assets. This topic covers the assets, billing, and limits for ActionTrail events.

    Asset Description

    Important

    Do not delete the Simple Log Service Project and LogStore that are used for ActionTrail events. If you delete them, operation events can no longer be pushed to Simple Log Service.

    • Custom Project

      Before you create a trail, you must create a Project.

    • Dedicated LogStore

      After you create a trail, Simple Log Service creates a LogStore named actiontrail_trail_name by default.

      • By default, indexing is enabled for this LogStore and indexes are configured for some fields.

        You can modify the indexes. The modifications apply only to new data. You can also reindex historical data. For more information, see Reindex data.

      • By default, this LogStore is configured for permanent retention. You can also change the log retention period. For more information, see Manage a LogStore.

        Important

        If you previously enabled the pay-by-ingested-data mode, the system creates a dedicated LogStore that uses the pay-by-ingested-data mode by default. To switch to the pay-by-feature mode, you can modify the LogStore configuration. For more information, see Modify the configurations of a LogStore.

    • Dedicated dashboard

      A dedicated dashboard is generated by default.

      Important

      The dedicated dashboard may be updated at any time. We recommend that you do not modify the dedicated dashboard. You can create custom dashboards to display query results. For more information, see Create a dashboard.

      Dashboard

      Description

      actiontrail_trail_name_audit_center_cn

      Displays real-time cloud resource operation metrics, including page views (PVs), unique visitors (UVs), source service counts, event source distribution, and PV/UV trends.

    Billing

    • ActionTrail bills you for its log management feature. For more information, see Billing overview.

    • After ActionTrail delivers logs to Simple Log Service, if the LogStore uses the pay-by-feature mode, Simple Log Service charges you for storage space, read traffic, requests, data transformation, and data shipping. For more information, see Pay-by-feature billing items.

    • After ActionTrail delivers logs to Simple Log Service, if the LogStore uses the pay-by-ingested-data mode, Simple Log Service charges you based on the amount of raw data ingested. For more information, see Pay-by-ingested-data billing items.

    Limits

    • The trail feature delivers audit events to an OSS Bucket or a Simple Log Service LogStore. You can create a maximum of five trails in total across all regions.

    • You cannot write other data to the dedicated LogStore. However, no special limits apply to features such as query, analysis, and alerting.

    Scenarios

    • Monitor cloud resource operations under your account in real time to troubleshoot abnormal activity. Use operation event records to trace accidental deletions and critical operations.

    • Analyze event data to track the distribution and sources of resource operations, and use insights to optimize product policies.

    • Query and analyze ActionTrail events in real time to view operation distribution and trends. This helps O&M engineers monitor the health of cloud resources.

    • Create custom query statements and saved searches for your operational needs, and build real-time dashboards based on resource usage and user logons.