Migrating your IBM Cloud Activity Tracker architecture

IBM Cloud Activity Tracker architectures

You have multiple options to manage activity tracking events in an account:

• Option 1: You can provision IBM Cloud Activity Tracker instances in different regions to collect and monitor activity tracking events that are generated in your account in each one of those regions.

  For example, you can operate in eu-de, eu-es, us-east, and us-south, and have IBM Cloud Activity Tracker instances provisioned in each one of these regions.

  

• Option 2: You can use IBM Cloud Activity Tracker Event Routing (a platform service) to route auditing events in your account to 1 or more destinations by configuring targets and routes that define where activity tracking events are sent.

  The following image shows a high-level view of the different IBM Cloud Activity Tracker Event Routing destinations:

  

  For example, you can configure IBM Cloud Activity Tracker Event Routing to route events to the IBM Cloud Activity Tracker service. For more information, see About IBM Cloud Activity Tracker Event Routing.

  • Scenario 1: You can route all activity tracking events into 1 IBM Cloud Activity Tracker instance.

    

  • Scenario 2: You can route activity tracking events that are generated in the account to different IBM Cloud Activity Tracker instances, for example, keeping the locality where the event is generated.

    

• Option 3: You can have a mix scenario where you manage events that are generated by some IBM Cloud services and collected in IBM Cloud Activity Tracker instances in the region where the service is provisioned and IBM Cloud Activity Tracker Event Routing configured to route auditing events in your account to 1 or more destinations by configuring targets and routes that define where activity tracking events are sent.

  

Options for migration

The IBM Cloud Activity Tracker service is deprecated.

You must migrate your IBM Cloud Activity Tracker instances to IBM Cloud Logs instances.

If you already use IBM Cloud Activity Tracker Event Routing, see Migrating IBM Cloud Activity Tracker Event Routing.

If you just have IBM Cloud Activity Tracker instances provisioned in your account, you must decide whether you want to keep the current IBM Cloud Activity Tracker architecture and maintain data locality or if you prefer to move to a centralize model where all activity tracking events are collected in a single IBM Cloud Logs instance.

Choose based on your requirements from any of the following options:

Migrating to a central model

You can manually migrate IBM Cloud Activity Tracker instances into 1 IBM Cloud Logs instance, and configure IBM Cloud Activity Tracker Event Routing in the account.

You can use the migration tool to migrate IBM Cloud Activity Tracker instances into 1 IBM Cloud Logs instance, and configure IBM Cloud Activity Tracker Event Routing in the account. For more information, see Migrating IBM Cloud Activity Tracker instances into 1 IBM Cloud Logs instance for centralize auditing events.

The following image shows a high-level view of the account after you migrate IBM Cloud Activity Tracker instances from multiple regions in the account into 1 instance of IBM Cloud Logs:

Migrating maintaing data locality

You can use the migration tool to migrate IBM Cloud Activity Tracker instances into N IBM Cloud Logs instances, replicating the current IBM Cloud Activity Tracker architecture. Then, after you have migrated all instances, you can use the migration tool to configure IBM Cloud Activity Tracker Event Routing in the account. For more information, see Migrating IBM Cloud Activity Tracker instances into N IBM Cloud Logs instances for data locality.

The following image shows a high-level view of the account after IBM Cloud Activity Tracker instances from multiple regions in the account are migrated into multiple instances of IBM Cloud Logs:

Migrating a mix service model

You can have a mix scenario where you manage events that are generated by some IBM Cloud services and collected in IBM Cloud Activity Tracker instances in the region where the service is provisioned, and IBM Cloud Activity Tracker Event Routing configured to route auditing events in your account to 1 or more destinations by configuring targets and routes that define where activity tracking events are sent.

Validating the new architecture

While you migrate and validate the new architecture, you must collect events in your IBM Cloud Activity Tracker instances, same as you currently do now. You must configure IBM Cloud Activity Tracker Event Routing to send activity tracking events to your IBM Cloud Activity Tracker instances with rules that map your current IBM Cloud Activity Tracker architecture in the account. If you fail to configure this route, activity tracking events will stop being routed to your current IBM Cloud Activity Tracker instances.

What IBM Cloud Activity Tracker Event Routing configuration do you need?

• 1 target per IBM Cloud Activity Tracker instance
• 1 target per IBM Cloud Logs instance that is the result of migrating an IBM Cloud Activity Tracker instance
• 1 route to send activity tracking events to your IBM Cloud Activity Tracker instances with rules that map your current IBM Cloud Activity Tracker architecture in the account.
• 1 route to send activity tracking events to your IBM Cloud Logs instances in the account.

Until you have validated the new architecture and you can remove the IBM Cloud Activity Tracker instances from the account, you must continue managing the account through the deprecated services.

For example, your validation configuration in the account should look like the following if you choose a central architecture:

For example, your validation configuration in the account should look like the following if you chose a data locality architecture:

Checklist to plan for migration

Consider these items when you are planning your migration of IBM Cloud Activity Tracker instances in an account:

• Check whether you use IBM Cloud Activity Tracker Event Routing to control and route where activity tracking events are sent. If you are using IBM Cloud Activity Tracker Event Routing, identify if you are routing events to IBM Cloud Activity Tracker instances. Are those instances located in the same account or in a different account?

• Identify the regions where you operate and in which of those regions there are IBM Cloud Activity Tracker instances provisioned. For more information, see IBM Cloud Activity Tracker supported locations.

• Check your requirements for long-term storage. Do you have archiving configured for each IBM Cloud Activity Tracker instance? How long do you need to keep the data?

  In IBM Cloud Logs, you can query all data that is stored in your configured IBM Cloud Object Storage bucket. You own and maintain the bucket and the data stored in it. A separate archiving solution is not required.

• Are you streaming any data to other 3rd-party tools?

  The data format of activity tracking events is not changed with the deprecation of the IBM Cloud Activity Tracker service.

• Are you excluding any data at ingestion to reduce costs that would be useful to keep for search or even for compliance? The IBM Cloud Logs service offers a TCO feature to help you optimize costs based on data criticality and operational requirements.

• Are you controlling data usage by configuring IBM Cloud Activity Tracker index rate alerts?

• Do you control access by using access groups? Do you use trusted profiles or service IDs? Identify the policies in the account that grant permissions to operate the IBM Cloud Activity Tracker instances in each account.

• What notification channels do you use for alerting? Email, Slack, PagerDuty, webhook, IBM Cloud Monitoring (Sysdig).