Ingest ActionTrail logs into Log Audit Service
By default, ActionTrail retains events for the last 90 days for each Alibaba Cloud account. Without a trail, you cannot access events older than 90 days. This topic describes how to create a trail to deliver events to a Project associated with Log Audit Service for long-term storage and analysis.
Background
When you use an Alibaba Cloud account to deliver events, events for that account and all its RAM users are delivered. When you use a RAM user to deliver events, you must first grant the RAM user permissions to manage trails. For more information, see Grant permissions to a RAM user.
How it works
When you create a trail to deliver events to Simple Log Service (SLS), the events are stored in a Logstore in JSON format. New events are typically delivered to your Logstore within one minute. This enables timely queries and analysis.
Step 1: Associate a project
Log Audit Service ingests ActionTrail logs into the associated Project.
-
Log on to the Simple Log Service console. In the Log Application section, on the Audit & Security tab, click Log Audit Service (New Version).
-
On the Log Audit (New Version) page, click Associate Project. In the dialog box that appears, configure the Project. For example, enter
sample-production-cn-shanghai. Then, click Confirm Association.For Region, select China (Shanghai).
Step 2: Create a trail
-
Log on to the ActionTrail console. In the left-side navigation pane, click Trails. On the Trails page, click Create Trail and configure the parameters in the Basic Information and Event Delivery sections. For example, set the trail name to
sample-production-actiontrailand deliver the events to the associated Simple Log Service destinationsample-production-cn-shanghai.NoteActionTrail automatically creates a Logstore named
actiontrail_<trail name>.For Trail Settings, select Management Event and choose All Events. For Delivery Account, select Deliver to Current Account. For Project, select Select Existing Project. For Logstore Region, select China (Shanghai). After completing the configuration, click Confirm.
-
After the trail is created, you can view its configuration details on the trail details page.
On the Event Delivery tab of the trail details page, verify that Simple Log Service (SLS) is configured. The Project Region is displayed as China (Shanghai), the Project Name is
sample-production-cn-shanghai, and the Logstore isactiontrail_sample-production-actiontrail.
Step 3: Verify log collection
-
On the Log Audit (New Version) page, click the name of the associated Project.
-
On the Cloud Service tab, check that ActionTrail is enabled, and then click View.
-
On the Query and Analysis > ActionTrail Logs page, confirm that the Logstore is
actiontrail_sample-production-actiontrail. Use search and analytic statements to query and analyze the data.Log collection is successful if you can find ActionTrail logs in the Logstore. For example, a query that returns a log count greater than 0 indicates success.
Related documentation
-
To allow a RAM user to manage Log Audit Service (New Version), an Alibaba Cloud account must grant the required permissions to the RAM user. For more information, see Grant a RAM user permissions to use Log Audit Service (New Version).
-
To learn how to manage log audit rules, see Manage collection rules for cloud services.
-
This topic uses ActionTrail logs as an example. For information about log types, default Project names, default Logstore names, and log billing for other cloud services, see Considerations for collecting logs from cloud services.