DocsICP FilingConsole
Documentation
Home Page ActionTrail User Guide Event query Event details query Query events in the ActionTrail console

Query events in the ActionTrail console

Updated at:
Copy as MD
Product
My Favorites

By default, ActionTrail records only the management events of the last 90 days for each Alibaba Cloud account. This topic describes how to query management events in the ActionTrail console.

Limits

  • In the ActionTrail console, you can query only the management events that are delivered by single-account trails. You can perform queries at most twice per second. You cannot query the management events that are delivered by multi-account trails in the ActionTrail console. To query such events, go to the required Object Storage Service (OSS) bucket or Simple Log Service Logstore. For more information, see Query events delivered by multi-account trails.

  • You can use the event query feature to query only the management events that are generated in the current region in the last 90 days.

    • To query the management events that were generated in the current region more than 90 days ago, you must create a single-account trail to deliver the management events to OSS or Simple Log Service. Otherwise, you cannot query the management events that were generated more than 90 days ago. For more information, see Create a single-account trail.

    • To query the management events that were generated in multiple regions more than 90 days ago, or to filter management events on multiple search conditions, you can use the advanced event query feature. For more information, see Custom event queries.

  • After a management event is generated within your Alibaba Cloud account, you must wait 10 minutes before you can query the event in the ActionTrail console.

Procedure

  1. Log on to the ActionTrail console.

  2. In the left-side navigation pane, click Events > Event Query.

  3. In the top navigation bar, select the region of the event that you want to query from the drop-down list.

  4. On the Event Detail Query page, enter query conditions, specify a time range, and then click the Query button icon.

    Note

    Note:

    • You can configure the following query conditions to query events: Service Name, Event Name, Operator, Read/Write Type, Event Type, Resource Type, Resource Name, AccessKey ID, Source IP Address, Sensitive Action, and Event ID.

    • You can query global events in the following regions:

      • Public cloud: China (Hangzhou).

      • Alibaba Finance Cloud: China East 2 Finance.

      • Alibaba Gov Cloud: China North 2 Ali Gov 1.

    For example, to find out who created a specific Resource Access Management (RAM) user, select CreateUser in the Event Name filter to query all RAM user creation events. CreateUser is a global event, so you must query it in the China (Hangzhou) region. Click to view the event details, and check the userIdentity.userName field in the event record to identify the creator.

    For example, to find out the account that created a VPC, perform the following steps:

    1. On the event query page, set Service Name to Virtual Private Cloud (VPC) and set Read/Write Type to Write.

    2. In the event list, find the CreateVpc event and click to view the event details.

    3. In the event details, check the userIdentity field to identify the account that created the resource:

      • accountId: the ID of the Alibaba Cloud account of the operator.

      • type: the identity type. For example, a value of root-account indicates that the operation was performed by the Alibaba Cloud account, and a value of ram-user indicates that the operation was performed by a RAM user. Other possible values are assumed-role, system, cloud-ssouser, alibaba-cloud-account, and apsara-cloud-account.

      • userName: the username of the operator.

      • principalId: the unique ID of the operator.

    Note

    CreateVpc is a region-specific event. You can query the event only in the region where the VPC was created. You do not need to switch to a specific region as you would for global events.

  5. Find the desired event and click View Event Details in the Actions column to view the event details and the event record, which is the raw JSON of the event.

    Note

    For more information about event fields, see Management event structure.

    For the descriptions of the userIdentity fields that you can use to identify the operator, such as userIdentity.type, userIdentity.userName, userIdentity.accountId, and userIdentity.principalId, see the userIdentity field list in the preceding CreateVpc example.

To query ActionTrail events, you must have the AliyunActionTrailFullAccess permission. If you do not have this permission, contact your Alibaba Cloud account administrator for authorization.

What to do next

In the ActionTrail console, you can download the management events that are displayed on the current page. To export management events in batches, create a trail that delivers them to Simple Log Service, and then download them from the Simple Log Service console. For more information, see Download ActionTrail events.

FAQ

Previous：Event details queryNext：Query events in cloud service consoles