How do I view the operation records of an ECS instance?-Elastic Compute Service(ECS)-阿里云帮助中心

Review who did what on an ECS instance and its resources over the past 90 days to troubleshoot issues and determine responsibility.

Note

The log data for the ECS Operation Records feature is provided by ActionTrail. By default, the data is retained for 90 days. To retain data longer, deliver it to your own storage service by creating a single-account trail.

Procedure

Go to ECS console - Instances.
In the upper-left corner of the page, select a region and resource group.

Click the instance ID to open the details page, and then click the Operation Records tab.

By default, the tab shows all operation records for the instance and its related resources over the past seven days.

Filter operation records by conditions such as Scope and Action Significance Level.

Filter condition	Description
Scope	Filters operations that affect the ECS instance, including: Actions on the ECS instance: Instance Configuration Actions: Modify hardware configurations such as the number of vCPUs, memory size, and disk space. Instance Status Actions: Change the instance status, such as from Running to Stopped. Instance Attribute Actions: Modify instance attributes such as the name, description, and tags. Instance Billing Actions: Change the billing method, such as from pay-as-you-go to subscription. Instance Create or Release: Create or release the instance. Instance Startup or Stop: Start or stop the instance. Economical Mode with Operating System Shutdown: Stop the instance in economical mode to reduce costs. Actions on resources related to the ECS instance: Security Group Create or Delete: Create or delete security groups for the instance. Security Group Configuration Change: Modify security group rules to allow or deny specific inbound or outbound traffic. Associated Security Group Actions: Update the security group rules associated with the instance. Associated ENI Actions: Modify ENI configurations such as IP addresses and subnets. Associated Disk Actions: Modify attached disk configurations, such as resizing or changing the disk category.
Read or Write	Filters by read or write type. Only Write is supported.
Time Range	Filters by time range. Covers the past 90 days. The start and end dates can be up to seven days apart.
Action Significance Level	Filters by action significance level. Valid values: High: May cause service interruption, such as StopInstance and RebootInstance. Prepare data backup and restoration policies in advance. Medium: Usually does not cause service interruption but may briefly affect services in specific scenarios, such as StartInstance. Monitor instance status changes and handle potential issues promptly. Low: Usually does not affect services, such as CreateDisk.
Action Name	Filters by API operation name. See List of operations by function.
User Name	Filters by the user who performed the operation.
Associated Resource ID	Filters by the resource ID associated with the operation.

On the Operation Records tab, click Details in the Actions column to view detailed operation records. See Management event structure.

Use cases

A company uses an Alibaba Cloud ECS instance to host critical business applications. One morning, the customer service team receives many reports about slow website response. The IT O&M team immediately logs on to the Alibaba Cloud Management Console to troubleshoot.

1. Check for issues

The IT O&M team uses CloudMonitor, Operation Records, and ActionTrail to retrieve recent logs and operation records of the ECS instance.

In the Host Monitoring page of CloudMonitor, you can view the Agent status, CPU usage, memory usage, and disk usage of each host. One host shows CPU usage at 100% (fully loaded), while the remaining hosts have CPU usage below 2%, indicating an anomaly on that host that requires further investigation.

2. Use ECS operation records

The IT O&M team opens the Operation Records tab, reviews operation records from the past few days, and discovers suspicious high-significance operations.

Among these, operations with a High change impact level include Modify Instance Type (ModifyInstanceSpec), Stop Instances (StopInstances), Modify Instance Network Bandwidth (ModifyInstanceNetworkSpec), and Modify Instance Attribute (ModifyInstanceAttribute).

To identify the root cause, the team clicks Details in the Actions column. Example operation details:

{
	"eventId": "11D139B3-BF38-5E16-B369-******",
	"eventVersion": 1,
	"responseElements": {
		"RequestId": "11D139B3-BF38-5E16-B369-******"
	},
	"eventSource": "ecs-cn-hangzhou-share.aliyuncs.com",
	"requestParameters": {
		"SourceRegionId": "cn-shanghai",
		"AcsProduct": "Ecs",
		"InstanceId": "i-uf******",
		"__referer__": "https://ecs.console.aliyun.com/server/region/cn-shanghai?instanceId=i-uf******&__refreshToken=1745474781230",
		"AcceptLanguage": "zh-CN",
		"ClientPort": 42079,
		"X-Acs-Client-Tls-Version": "TLSv1.3",
		"RegionId": "cn-shanghai",
		"InstanceType": "ecs.******",
		"X-Acs-Client-Tls-Cipher-Suite": "TLS_AES_256_GCM_SHA384"
	},
	"sourceIpAddress": "124.89.******",
	"userAgent": "ecs.console.aliyun.com",
	"eventRW": "Write",
	"eventType": [
		"spec",
		"instanceCost"
	],
	"referencedResources": {
		"ACS::ECS::Instance": [
			"i-uf******"
		]
	},
	"userIdentity": {
		"sessionContext": {
			"attributes": {
				"mfaAuthenticated": "false",
				"creationDate": "2025-04-24T06:06:54Z"
			}
		},
		"accountId": "5237******",
		"principalId": "523******",
		"type": "root-account",
		"userName": "ZhangSan"
	},
	"serviceName": "Ecs",
	"additionalEventData": {
		"CallerBid": "26888"
	},
	"apiVersion": "2014-05-26",
	"requestId": "11D139B3-BF38-5E16-B369-*******",
	"eventTime": "2025-04-24T06:06:54Z",
	"isGlobal": false,
	"acsRegion": "cn-shanghai",
	"eventName": "ModifyInstanceSpec",
	"resourceName": "i-uf*******",
	"userName": "root",
	"originEventType": "ConsoleOperation",
	"eventLevel": "high"
}

eventTime: when the operation was performed.
sourceIpAddress: the IP address that initiated the operation.
resourceName: the resource on which the operation was performed.
accountId and userName: the account ID and name of the operator.
eventName: the API operation name. For example, ModifyInstanceSpec means the instance type was changed.

Note
See List of operations by function.

3. Analyze operation records

From the operation records, the team learns that instance configurations were modified the previous afternoon. No issues appeared immediately, but as user traffic increased, CPU utilization rose to 100%, degrading the online business.

4. Contact relevant personnel

The team contacts the engineer responsible for the modification to obtain details. The engineer may not have correctly assessed resource requirements, leading to insufficient performance after the change.

5. Use ActionTrail for auxiliary analysis

To verify the root cause, the team uses ActionTrail for more detailed logs, including specific API call parameters and event IDs. The team uses Query Events to confirm that other ECS instances in the same account are unaffected.

In the ActionTrail console, click Event Query in the left-side navigation pane, filter the event name to ModifyInstanceSpec, and select China (Shanghai) as the region. In the query results, click an event to open the View Details panel. You can confirm that the event type is Console Operation, the cloud service name is Elastic Compute Service (ECS), and the event record JSON contains the target InstanceId and the source ECS console URL.

6. Restore and optimize resource configurations

Based on the operation records and ActionTrail data, the team restores the original configurations and re-evaluates resource requirements:

Restore the original configurations. Revert the instance to its original type.
Monitor instance performance. Continuously monitor instance performance to ensure services recover.
Re-evaluate resource requirements. Develop a resource configuration plan based on actual workload.