Docs

Torch Log Service

CloudTrail log collection

Collect CloudTrail logs

This topic describes CloudTrail log features and collection methods.

Features overview

CloudTrail is an account access log auditing service provided by Volcengine. With CloudTrail, you can monitor the activities of the master account, subusers, roles, and other identities that access the console and OpenAPI.

Audit logs can be delivered to the specified TLS according to set filtering criteria.

The related configuration is as follows:

Configuration	Description
Log type	Operation audit event tracking log.
Log storage location	When creating an event tracking task in Operation Audit, you can follow the console instructions to create the corresponding project and log topic. For details on managing log resources, see Manage CloudTrail log resources. Project: Custom Log topic: Custom
Log storage period	The default period is 30 days.
Log shards	Preset with 5 shards. Support auto split for log topic shards. When the write traffic increases rapidly, shards are split to meet data writing requirements.
Index settings	Configure indexes are automatically configured.
Log fields	For a detailed list of log fields, see CloudTrail log fields.

Collect CloudTrail logs

Usage restrictions and the task creation process for tracking CloudTrail events to TLS are detailed in Event tracking (Log Transfer).

CloudTrail log fields

Field	Description
EventVersion	Event version, currently V1.1.
EventID	The unique ID of the event identifies an audit log.
RequestID	The request ID identifies a unique request. One request ID may link multiple events.
EventTime	The time when the event occurred.
EventType	Event type. Values are as follows: Console access: ConsoleOperation; programmatic access: ApiCall; login: ConsoleSignIn; logout: ConsoleSignOut.
UserIdentity	Information related to the requester's identity. This field contains multiple items. For details, see the UserIdentity field description below.
EventSource	The requested cloud service. Usually it is the English name of the cloud product, for example: ecs.
EventName	The name of the request. Usually it is the API name of the cloud product, for example: Runinstance.
Region	The requested region, such as: cn-beijing.
SourceIPAddress	The source IP address of the request. If the request is initiated by Volcengine cloud services, this field displays the name of the service making the request.
UserAgent	The client agent making the request. This may include browser and version details or SDK and version information.
RequestParameters	The parameters transmitted in the request. This field may be missing for certain cloud products, depending on their support.
ResponseElements	The response parameters returned for the request. This field may be missing for certain cloud products, depending on their support.
ReadOnly	This field is used to indicates the operation type of the event. If true, the event is read type, which corresponds to read-only operation request. If false, the event type is write type, which corresponds to write operation request. This field may be missing for some cloud products due to the lack of support(by defalut, it is false).
Resources	The cloud resource accessed by the event. This field may be missing for certain cloud products, depending on their support.
ApiVersion	The API version of the event request, which matches the version provided in the cloud product API documentation.

UserIdentity field description

Field	Description
AccountID	The primary account ID associated with the requester identity.
Type	The requester identity type. Possible values are root, IAMUser, AssumedRole, and Service, representing the primary account, IAM user, IAM role, and cloud service, respectively.
PrincipalID	The requester identity ID.
UserName	The requester identity name. When the primary account makes the request, this displays as the fixed value root. When a sub-user makes the request, this displays as ${UserName}, which is the user name. When a role makes the request, this feild displays as ${RoleName}/${RoleSessionName}. Here, ${RoleName} is the role name and ${RoleSessionName} is the temporary session identifier which is used to distinguish between different sessions of the same role.
TRN	Resource name identifier for the requester's identity.
AccessKeyID	Access Key Id used by the requester to authenticate.

Last updated: 2026.06.12 17:31:00