Working with events in a region where IBM Cloud Activity Tracker Event Routing is not available
In IBM Cloud, auditing events that are generated by IBM Cloud services in a region, location, or datacenter where the IBM Cloud Activity Tracker Event Routing service is not available are managed through a different region.
There are different scenarios that can trigger this situation:
-
A new region opens a new MZR for business in IBM Cloud. For example, Madrid region has recently open for business in June 2023. However, IBM Cloud Activity Tracker Event Routing availability is planned for a later date.
-
IBM Cloud Activity Tracker Event Routing is not available in all the regions, locations, or datacenters where an IBM Cloud service is. For example, you can provision classic infrastructure resources in the San Jose datacenter, and monitor auditing events through the US-South region where Activity Tracker Event Routing is available.
In any of these situations, you can monitor activity in your account for DevOps, for compliance, or both. Services that generate auditing events are configured to send them to a different region where the IBM Cloud Activity Tracker Event Routing service is available. You can monitor what is happening in the IBM Cloud at all times for that service.
Understanding auditing events
IBM Cloud Activity Tracker Event Routing provides the ability to collect auditing events for enabled IBM Cloud services. Some services might require a service plan upgrade or configuration setting changes to enable event tracking. Auditing events can help you investigate abnormal activity and critical actions.
There are two types of events:
- Location-based
- Location-based events are events that are associated with services running in a particular IBM Cloud region.
- Global
- Global events are events generated by services that provide services for IBM Cloud as a whole. An example of a service that generates global events is IBM Cloud® Identity and Access Management.
Events are routed based on a field value included in the event. You can define a set of routes, targets, and rules to determine where the events will be sent and stored. Events can be routed to an IBM Cloud Object Storage bucket, an IBM Cloud Logs instance, or IBM® Event Streams for IBM Cloud®.
For compliance purposes you might have to maintain your data within a particular country or region.
Each IBM Cloud service documents the IBM Cloud Activity Tracker Event Routing events that it collects. See IBM Cloud Activity Tracker Event Routing events for information on the services sending events and the events that are sent.
How can you identify data from the Madrid location?
Auditing events include the field logSourceCRN that specifies the region, location, or datacenter where the resource is available. For example, for Madrid, you can see the location of events set to eu-es.
Services that operate in non-supported Activity Tracker Event Routing regions
The following list outlines services that operate in non-supported Activity Tracker Event Routing regions and generate auditing events: