Collect ActionTrail logs with Log Audit Service

Background

• ActionTrail helps you monitor and record activity in your Alibaba Cloud account, including access to and use of cloud services through the Alibaba Cloud Management Console, OpenAPI, and developer tools. By default, ActionTrail tracks and records events from the last 90 days and supports online event review. For more information, see What is ActionTrail?.

• Log Audit Service is built on Log Service. It supports centralized log management through the multi-Log Project center, which allows you to aggregate, query, measure, and analyze logs from cloud services in one place. This helps you meet regional data compliance requirements and manage data flow effectively. For more information, see Overview of Log Audit Service (New).

Overview

Follow these steps to enable ActionTrail log collection in Log Audit. Log Audit supports configurations for multiple cloud services. For details about log types, default Project names, default Logstore names, and log billing for different cloud services, see Notes on collecting logs from cloud services.

Prerequisites

• Ensure that Log Service (SLS) is activated. For more information, see Use LoongCollector to collect and analyze ECS text logs.

• ActionTrail must be activated. For more information, see Enable ActionTrail.

Step 1: Associate a project

1. Log on to the Log Service console and create a Project. For example, create a Project named sample-production-cn-hangzhou in the China (Hangzhou) region.

2. In the Log Application section, on the Audit & Security tab, click Log Audit Service (New Version).

3. On the Log Audit Service (New) page, click Associate Project. In the dialog box that appears, select the Project to associate and then click Associate.

   Note

   ActionTrail logs are ingested into the Project associated with Log Audit.

   The dialog box contains the following settings: Region, Project, and Notes.

4. On the Log Audit page, click the name of the associated Project.

5. On the Cloud Service tab, select ActionTrail and click Enable Now.

Step 2: Create a trail

1. In the ActionTrail > Enable panel, review the requirements for creating a trail, and then go to the ActionTrail console.

   The requirements are as follows: the trail name is not restricted, Trail Settings is set to all events, Event Delivery is configured to deliver events to Log Service, Delivery Account is set to the current account, the Logstore region is China (Hangzhou), and the Log Project is sample-production-cn-hangzhou. The log collection rule for ActionTrail is considered enabled only when a Logstore whose name starts with actiontrail_ exists in the Project associated with Log Audit.

2. In the ActionTrail console, configure the Basic Information and Event Delivery sections to create the trail.

   In the left-side navigation pane, click Trails. On the page that appears, in the Basic Information section, set Trail Name to a custom name, such as sample-production-actiontrail. For Trail Settings, select Management Events and then select All Events. For Apply to All Members, select No. In the Event Delivery section, select Deliver events to Log Service. For Delivery Account, select Current account. For Log Project, select Select Existing Log Project. For Logstore Region, select China (Hangzhou). For Log Project Name, select sample-production-cn-hangzhou. After completing the configuration, click OK.

3. After the trail is created, view its details. The default Logstore created by ActionTrail is actiontrail_sample-production-actiontrail.

   Note

   ActionTrail automatically creates a Logstore named actiontrail_<trail_name>.

   On the trail details page, click the Event Delivery tab to view the Log Service delivery configuration. The Log Project Name is sample-production-cn-hangzhou, and the Log Project region is China (Hangzhou).

Step 3: Query and analyze logs

1. In the Log Audit list, navigate to the target Project. On the Cloud Service tab, select ActionTrail from the Enabled Cloud Services list and click View.

2. On the Query & Analysis > ActionTrail Logs page, query and analyze the logs.

   Enter a query in the search box and click Search & Analysis.

Related documentation

• To enable indexing for a Logstore, see Create an index. To query and analyze logs in a Logstore, see Quick start for log query and analysis.

• This topic uses ingesting ActionTrail logs into Log Audit as an example. For details about log types, default Project names, default Logstore names, and log billing for other cloud services, see Notes on collecting logs from cloud services.