View the operation log

Basic event query

You can query only specific types of events that occurred within the last 90 days.

1. Log on to the GA console.

2. In the left-side navigation pane, choose Log Management > Operations Log.

3. On the Operations Log page, filter the logs.

   Note

   If the advanced event query page appears, click Switch to Basic Event Query in the upper-right corner.

   1. Select an event type.

      Event type	Supported options
      Read/Write Type	Valid options are Write and Read.
      Username	You can enter a username. For example, user1 represents a RAM user.
      Resource Type	Select a resource type from the drop-down list.

   2. Select a time range for events within the last 90 days.

   3. Click to search.

4. Find the operation log you want to view and click the icon next to it to view its details.

5. View details about the event in the section that appears.

   1. Click Event Details.

   2. In the Event Details dialog box, view the event record in XML format. You can click the icon on the right to copy the record to a local file or another location.

Advanced event query

Use flexible filter conditions or SQL statements to query events older than 90 days or across multiple regions. Advanced event query supports Standard mode and Simple mode. You can choose a mode based on your needs. The following table describes the use cases for each mode.

1. Log on to the GA console.

2. In the left-side navigation pane, choose Log Management > Operations Log.

3. The first time you view the operation log, click Enable Advanced Event Query.

   1. In the Enable Advanced Event Query panel, select Create Trail or Select an existing trail.

   2. Enter a name for the trail.

   3. Click Activate Now to activate Log Service (SLS).

      Note

      • To deliver audit events to a Log Service Logstore, you must first activate and authorize Log Service. Once authorized, ActionTrail automatically stores your audit events in the specified Logstore, where you can easily view and manage them.

      • Delivering data to Log Service incurs minor fees, which are estimated based on your event volume over the last 30 days. You can click View Trail Cost Estimation to learn more.

   4. Click OK.

4. On the Operation Log page, choose one of the following methods to view the operation log for GA.

   Note

   If you do not set any filter conditions, all events are queried by default.

   Standard mode (default)

   1. Enter filter conditions.

   2. Click Search.

   Simple mode

   1. Click Switch to Simple Mode.

   2. In the text box, enter a query statement or use keywords to specify conditions for Who, What, Which, Where, or Other.

   3. Click Search.

5. In the list of filtered events, click the icon next to the target event.

6. View details about the event in the section that appears.

   1. Click Event Details.

   2. In the Event Details dialog box, view the event record in XML format. You can click the icon on the right to copy the record to a local file or another location.

7. After using the advanced event query feature, you can perform these optional operations on the Operations Log page:

   • To switch back to basic event query, click Switch to Basic Event Query on the right side of the page.

   • Delivering data to Log Service incurs minor fees. To stop these charges, do the following:

     1. Click the trail name. On the trail details page, turn off Trail Status.

     2. Return to the Operations Log page in the GA console. Click the Log Service link, hover over the target Logstore, and then choose > Delete.

   • To disable the advanced event query feature, do the following:

     1. Click the trail name link. In the left-side navigation pane, click Trails. On the Trails page, turn off Advanced Query.

     2. Return to the Operations Log page in the GA console and refresh the page. The Operations Log page switches back to the basic event query view.