Simple Log Service and ActionTrail jointly launch the event delivery feature that allows you to collect events as logs to Simple Log Service in real time. After logs are collected to Simple Log Service, you can query, visualize, analyze, deliver, and consume the logs in real time. You can also configure alerts for the logs. This helps you monitor the operations on cloud resources. This topic describes the assets, billing, and limits of the event delivery feature.
Assets
Do not delete the project or Logstore that is related to ActionTrail events. Otherwise, ActionTrail events cannot be sent to Simple Log Service.
Custom project
Before you create a trail, you must create a project.
Dedicated Logstore
After you create a trail, Simple Log Service creates a Logstore named actiontrail_Trail name by default.
The indexing feature is automatically enabled for the Logstore. Indexes are automatically configured for specific fields.
You can modify the indexes. New indexes take effect only on data that is generated after the modification. You can also reindex historical data. For more information, see Reindex logs for a Logstore.
By default, logs are permanently stored in the Logstore. You can change the log retention period. For more information, see Manage a Logstore.
ImportantIf you have enabled the pay-by-ingested-data billing mode, Simple Log Service creates a dedicated Logstore that uses the pay-by-ingested-data billing mode by default. If you want to switch the billing mode from pay-by-ingested-data to pay-by-feature, you can modify the configuration of the Logstore. For more information, see Modify the configuration of a Logstore.
Dedicated dashboard
By default, Simple Log Service generates a dashboard after you enable the feature.
ImportantWe recommend that you do not make changes to the dedicated dashboard because the dashboard may be upgraded or updated at any time. You can create a custom dashboard to visualize query results. For more information, see Create a dashboard.
Dashboard
Description
actiontrail_Trail name_audit_center_cn
Displays the real-time details of operations on cloud resources. The details include page views (PVs), unique visitors (UVs), number of source services, distribution of event sources, and trends of PVs and UVs.
Billing
The fees of the event delivery feature are included in the bills of ActionTrail. For more information, see Billing.
If the dedicated Logstore uses the pay-by-feature billing mode, you are charged for storage, read traffic, number of requests, data transformation, and data shipping after the logs are collected from ActionTrail to Simple Log Service. The fees are included in the bills of Simple Log Service. For more information, see Billable items of pay-by-feature.
If the dedicated Logstore uses the pay-by-ingested-data billing mode, you are charged based on the ingested raw data volume after the logs are collected from ActionTrail to Simple Log Service. The fees are included in the bills of Simple Log Service. For more information, see Billable items of pay-by-ingested-data.
Limits
You can use ActionTrail trails to deliver events to Object Storage Service (OSS) buckets or Simple Log Service Logstores. You can create up to five trails in a region.
You can write only ActionTrail logs to the dedicated Logstore. No limits are imposed for features such as query, analysis and alerting.
Scenarios
You can use the feature to monitor the operations on the cloud resources of your Alibaba Cloud account and troubleshoot and analyze unusual operations. You can also use ActionTrail events to trace accidental deletions and high-risk operations.
You can use event analysis results to trace the distribution and source of operations on essential cloud resources and optimize strategies on the cloud resources.
You can query and analyze ActionTrail events and view information such as the distribution and time trends of operations on all resources. This helps O&M engineers monitor the status of cloud resources in real time.
You can use custom query statements and saved searches based on your operations and data requirements. You can also create custom dashboards based on your resource usage and user logons to monitor data in real time.