FAQs

1. What is the longest query period supported by ActionTrail?

By default, you can query event logs of the last 30 days. If you need to keep event logs for a longer period of time, you can back up the event logs periodically by calling an API operation or exporting event logs.

• The following figure shows how to export logs in the ActionTrail console.

2. What filters can I use to search for events?

You can search for events by username, resource type, resource name, event name, AccessKeyID, read/write type, and time period during which events occurred.

3. What information is recorded for an event?

An event log contains the AccessKeyID, event source, region, error code, event ID, event name, event time, request ID, source IP address, resource type, and username.