ActionTrail provides various methods for you to query events.

The following table describes the methods that you can use to query events in different scenarios.

Scenario Query method References
Query management events that were generated in the last 90 days Perform event detail queries.

You can perform event detail queries to query management events that were generated in the last 90 days. You can specify only one filter condition for each event detail query.

Query events in the ActionTrail console
Query statistics collected at intervals of 2 hours for management events that were generated in the last 90 days Perform event summary queries.

You can perform event summary queries to query the statistics collected at intervals of 2 hours for management events that were generated in the last 90 days. This helps improve the online query efficiency of events. You can specify only one filter condition for each event summary query.

Event summary query
Query events that were generated more than 90 days ago Perform advanced event queries.

If you enable the advanced event query feature for an existing trail, you can perform advanced event queries to query management events and insight events that were generated both in the last 90 days and more than 90 days ago. You can specify multiple filter conditions for each advanced event query.

Perform advanced event queries
Query exceptional operations that were performed in the last 90 days Perform insight event queries.

You can perform insight event queries to query exceptional operations that were performed in specific scenarios in the last 90 days. You can specify only one filter condition for each insight event query. For example, an IPInsight event helps you gain an insight into an operation that was performed from an unusual IP address and identify potential risks at the earliest opportunity. You can perform online queries of IPInsight events that were generated in the last 90 days.

Query insight events in the ActionTrail console