ActionTrail tracks and records events in your Alibaba Cloud account for the past 90 days.
Procedure
Activate MaxCompute and DataWorks. For more information, see Activate MaxCompute.
If you use a RAM user to deliver ActionTrail events, you must first grant the RAM user permissions to manage a single-account trail. For more information, see Grant permissions to a RAM user.
Log in to the ActionTrail console.
In the left-side navigation pane, click Trails. In the top-left corner, select a region.
A trail is a configuration for delivering ActionTrail events. Trails are classified as single-account, multi-account, or platform event trails based on their creator, scope, and the events they deliver. For more information, see Overview of trails.
On the Trails page, click Create Trail.
In the Create Trail dialog box, click Create.
When you create a trail, ActionTrail automatically creates a service-linked role named AliyunServiceRoleForActionTrail and adds it as the Admin role to the destination MaxCompute project. For more information, see ActionTrail service-linked role and Role planning.
Configure the following parameters and click OK.
In the Basic Information section, enter a custom Trail Name and select a Trail Event Type.
Single-account trails are suitable for individual users, and multi-account trails are suitable for enterprise users.
Trail names must be unique within the same Alibaba Cloud account.
In the Management Event Delivery Settings section, select Delivery to MaxCompute.
Set Destination Account to Delivery to Current Account and configure the following parameters.
Parameter
Description
MaxCompute Region
The region of the destination MaxCompute project.
ActionTrail delivers events to the actiontrail_<Alibaba Cloud account ID> project in the specified MaxCompute region. MaxCompute project names are unique within an Alibaba Cloud account. Therefore, if a project named actiontrail_<Alibaba Cloud account ID> already exists, events are delivered to that project by default.
Project Quota
The MaxCompute billing quota.
When you create a trail to deliver events to MaxCompute for the first time, you must select a MaxCompute quota. If no quota is available in the current region, select a different MaxCompute region.
Set Destination Account to Delivery to Another Account, and then specify the Project ARN and RAM Role ARN of MaxCompute.
To deliver events to another account, you must first create a MaxCompute project and a RAM role in the destination account. The RAM role authorizes ActionTrail to deliver events to that account. For more information, see Deliver events from multiple Alibaba Cloud accounts to a single account.
After the trail is created, ActionTrail saves events in JSON format to the
actiontrail_<trail name>table in the MaxComputeactiontrail_<Alibaba Cloud account ID>project. Writing ActionTrail event data to the specified MaxCompute table incurs storage fees. For more information, see Storage fees.
References
To query and analyze ActionTrail events in the
actiontrail_<trail name>table, connect to MaxCompute. For more information, see Select a connection tool.Running SQL commands in MaxCompute incurs compute fees. For more information, see Billable items and billing methods.
To update a trail, see Update a single-account trail and Update a multi-account trail.
To delete a trail, see Delete a single-account trail and Delete a multi-account trail.
To stop event delivery while retaining the trail's configuration, see Disable a single-account trail and Disable a multi-account trail.