--- name: atracker-getting-started title: Getting started with IBM Cloud Activity Tracker Event Routing description: Use IBM Cloud® Activity Tracker Event Routing to configure how to route auditing events, both global and location-based event data, in your IBM Cloud. Auditing events are critical data for security operations and a key element for meeting compliance requirements. Control of the storage location is critical to building enterprise-grade solutions on the IBM Cloud. last-updated: 2026-06-25 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/atracker?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Getting started with IBM Cloud Activity Tracker Event Routing {: #getting-started} Use IBM Cloud® Activity Tracker Event Routing to configure how to route auditing events, both [global](https://cloud.ibm.com/docs/atracker?topic=atracker-event_types&format=markdown#event_types_global) and [location-based](https://cloud.ibm.com/docs/atracker?topic=atracker-event_types&format=markdown#event_types_location) event data, in your IBM Cloud. Auditing events are critical data for security operations and a key element for meeting compliance requirements. Control of the storage location is critical to building enterprise-grade solutions on the IBM Cloud. {: shortdesc} You can use Activity Tracker Event Routing, a platform service, to manage auditing events at the account-level by configuring targets and routes that define where auditing data is routed. Activity Tracker Event Routing can route events that are generated in [supported regions](https://cloud.ibm.com/docs/atracker?topic=atracker-regions&format=markdown). For more information about IBM Cloud Activity Tracker Event Routing, see [About Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-about&format=markdown). ## Prerequisites {: #getting-started-prereqs} - [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli&format=markdown). - [Install the IBM Cloud Activity Tracker Event Routing CLI](https://cloud.ibm.com/docs/atracker?topic=atracker-atracker-cli-config&format=markdown). - You must have a user ID with permissions to manage IBM Cloud Activity Tracker Event Routing. For more information about IAM roles and how to assign them, see [Managing access with IAM](https://cloud.ibm.com/docs/atracker?topic=atracker-iam&format=markdown) and [IAM roles](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources&format=markdown). ## Step 1. Configure the account global settings {: #getting-started-step1} When you configure Activity Tracker Event Routing in your account, you can configure the account settings such as the metadata location, type of endpoints allowed to manage the configuration, locations where targets can be defined, and default targets for collecting auditing events in regions that you have not explicitly configured. For more information, see [Configuring Activity Tracker Event Routing account settings](https://cloud.ibm.com/docs/atracker?topic=atracker-settings&interface=cli&format=markdown). Set these settings to define where and how auditing events are collected, routed, and managed in your account. For example, to configure the primary metadata location that defines the region where all your Activity Tracker Event Routing resource definitions are stored, run the following command: ```pre ibmcloud atracker setting update --metadata-region-primary ``` {: codeblock} Where `` you can set the region to any of the supported locations where Activity Tracker Event Routing is available. When you set the metadata location, check any compliance or industry regulations that apply to data location. {: tip} ## Step 2. Configure 1 target {: #getting-started-step2} A target defines where auditing events are collected. For more information about targets, see [Understanding how targets work in your account](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2&interface=cli&format=markdown#target_v2_behavior). Choose 1 of the following options to configure a target in your account: - [Configuring an IBM Cloud App Configuration target](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-target-apprapp&format=markdown). - [Configuring an IBM Cloud® Object Storage target](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-target-cos&format=markdown). - [Configuring an IBM Cloud Logs target](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_icl&format=markdown). - [Configuring an Event Streams target](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-target-event-streams&format=markdown). The rest of the instructions assume that you configure a `cloud-object-storage` target. ## Step 3. Configure 1 route {: #getting-started-step3} A route defines the rules that indicate where auditing events that are generated in an account are routed. Routes are global under an account and are evaluated in all regions where Activity Tracker Event Routing is deployed. For more information, see [Understanding how routes work in your account](https://cloud.ibm.com/docs/atracker?topic=atracker-route_v2&interface=cli&format=markdown#route_behaviour). In this step, you will configure a route to redirect regional and global events to a target bucket. Run the following command to create the route: ```text ibmcloud atracker route create --name --rules ``` {: pre} Where `--name ` : The name to be given to the route. `--rules ` : A JSON formatted rule definition enclosed in single quotes. For example: ```json --rules '[{"locations":["global"],"target_ids":["11111111-1111-1111-1111-111111111111"]},{"locations":["us-south","us-east"],"target_ids":["22222222-2222-2222-2222-222222222222","33333333-3333-3333-3333-333333333333"]}]' ``` {: codeblock} After you configure a route, it might take up to 1 hour for the configuration to be enabled. {: note} For example, to create a route to send auditing events to a target that you created in the previous step, run the following command. ```text ibmcloud atracker route create --name "my-route" --rules '[{"locations":["global","eu-de"],"target_ids":["TARGETID"]}]' ``` {: pre} Where `TARGETID` is the ID of the target that you created in the previous step. ## Step 4. Verify collection of events {: #getting-started-step4} After the target and the route is configured, you must verify that auditing events are available in your bucket. For example, auditing events are stored in log files in the bucket. Log files are structured and named as follows: ```text /T/2021-02-23T15:38+05.log ``` {: codeblock} Where - `` defines the region from where auditing events are collected. For example, valid values are `us-south` and `us-east`. - `` defines the date when auditing events are collected. The format is `YYYY-MM-DD`. - `` defines the hour of the day. The value is set by using a 24-hour clock. - `` defines a timestamp. The format is `YYYY-MM-DDTHH:MM+SS`. Each log file includes auditing events that have an `eventTime` that maps the filename timestamp. `eventTime` indicates when the auditing event was generated. For example, a sample log file that collects auditing events in the US-South region looks as follows: ```text us-south/2021-02-23T15/2021-02-23T15:38+05.log ``` {: screen} You can choose any of the following methods to list objects in a bucket: - [List objects in a given bucket by using the CLI](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-ic-cos-cli&format=markdown#list-objects-v2). - [List objects in a given bucket by using the API](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operations&format=markdown#compatibility-api-list-objects-v2) - [List objects in a given bucket through the IBM Cloud UI](https://cloud.ibm.com/docs/atracker?topic=atracker-cos&format=markdown#cos_bucket_list_objects_ui). Alternatively, you can use pre-built, open-source and enterprise-ready [Terraform IBM Modules (TIM)](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-about-tim&format=markdown) for [IBM Cloud Activity Tracker Event Routing](https://registry.terraform.io/modules/terraform-ibm-modules/activity-tracker/ibm/latest){: external} to configure targets, routes and account settings. This module simplifies the creation and management of targets and routes following the best practices. {: tip} ## Next {: #getting-started-next} Plan your account configuration. For more information, see [Planning the account configuration](https://cloud.ibm.com/docs/atracker?topic=atracker-planning&format=markdown).