Managing events in a new location after Activity Tracker is available

You must take action to manage events from IBM Cloud services that generate auditing events in a new region where the IBM Cloud Activity Tracker Event Routing service is not available until a later date.

For example, the Madrid region opened for business in June 2023. IBM Cloud services that are available and generate auditing events send currently those events to the Frankfurt region. You can manage and monitor interaction with these services in Frankfurt. Auditing events include the field logSourceCRN that specifies the region, location, or datacenter where the resource is available. For example, for Madrid, you can see the location of auditing events set to eu-es.

Step 1. Prepare

You cannot control when an IBM Cloud service makes the switch of sending auditing events from one region to another one. However, you can add a new rule for Madrid to prepare for that switch.

Data is not sent to both locations, so you must take action before that switch is done by a service to mitigate any loss of data.

Figure 1. Flow of events in a single region

Consider the following to plan for the switch over:

Is IBM Cloud Activity Tracker Event Routing available in the new region?
Do you have any rules defined to route events for Madrid? Do you need to define new targets in Madrid to route those events to them?

Step 2. Configure targets in Madrid

A target defines where auditing events are collected. For more information about targets, see Understanding how targets work in your account.

Choose 1 of the following options to configure a target in Madrid in your account:

Step 3. Configure or modify a route to include a rule for Madrid

A route defines the rules that indicate where auditing events that are generated in an account are routed. Routes are global under an account and are evaluated in all regions where Activity Tracker Event Routing is deployed. For more information, see Understanding how routes work in your account.

For example, in this step, you will reconfigure a route to redirect events that are generated in Madrid to a target bucket.

Run the following command to create the route:

ibmcloud atracker route update --route <ROUTE_NAME> --rules

Where

--route <ROUTE_NAME>

The name of the route.

--rules <ROUTING_RULES>

A JSON formatted rule definition enclosed in single quotes. You must keep existing rules and add new rules for Madrid. For example:

--rules '[{"locations":["global"],"target_ids":["11111111-1111-1111-1111-111111111111"]},{"locations":["us-south","us-east"],"target_ids":["22222222-2222-2222-2222-222222222222"]},{"locations":["eu-es"],"target_ids":["ID-OF-NEW-TARGET"]}]'

After you configure a route, it might take up to 1 hour for the configuration to be enabled.

For example, to create a route to send auditing events to a target that you created in the previous step, run the following command.

ibmcloud atracker route create --name "my-route" --rules '[{"locations":["eu-es"],"target_ids":["TARGETID"]}]'

Where TARGETID is the ID of the target that you created in the previous step.