The operation log feature for Classic Load Balancer (CLB) records activities related to the CLB service in your account.
Background information
The CLB operation log feature is integrated with ActionTrail. ActionTrail records activities in your Alibaba Cloud account, including operations performed through the Alibaba Cloud Management Console, APIs, and developer tools.
Query logs
-
Log on to the CLB console.
-
In the left-side navigation pane, choose .
-
On the Operation Log page, select an Event Type, specify the Event Time (up to 90 days), and then click
to filter the logs.Event type
Supported options
Read/Write Type
You can select either Write or Read.
User Name
Enter a username to filter the results. For example, user1 indicates a RAM user.
Resource Type
Select a resource type from the drop-down list.
Event Name
Enter a specific API event name to filter by. For example, entering SetLoadBalancerStatus finds records of operations that start or stop a CLB instance.
-
In the list of filtered events, click the
icon next to the target event, and then click Event Detail. In the Event Detail dialog box, view the event record in XML format. You can then click 
to copy the record.
Troubleshooting example: CLB instance stops unexpectedly
When a CLB instance stops unexpectedly, you can use the operation log to identify the cause of the stop, such as a manual action or a system issue.
To troubleshoot this issue, follow these steps:
-
On the Operation Log page, set Event Name to SetLoadBalancerStatus, select the appropriate time range, and filter the results.
-
In the filtered results, click the target event to view its details. Focus on the following fields:
-
event source: The service endpoint where the operation originated, such as
slb-openapi-share.aliyuncs.com. -
event type:
ConsoleOperationindicates an operation performed in the console, andApiCallindicates an API call. -
operator: The identity of the user who performed the operation. For example,
rootindicates the root account, and a RAM username indicates a RAM user.
-
-
Based on this information, you can determine which account stopped the CLB instance and how the operation was performed. For example, if the event type is
ConsoleOperationand the operator is root, this indicates that the instance was manually stopped by the root account in the console.