Activity tracking events for Cloud Databases

IBM Cloud® services, such as Cloud Databases, generate activity tracking events.

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.

You can use IBM Cloud® Activity Tracker Event Routing, a platform service, to route auditing events in your account to destinations of your choice by configuring targets and routes that define where activity tracking events are sent. For more information, see About IBM Cloud Activity Tracker Event Routing.

You can use IBM® Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

As of 28 March 2024, the IBM Cloud Activity Tracker service is deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs before 30 March 2025. During the migration period, customers can use IBM Cloud Activity Tracker along with IBM Cloud Logs. Activity tracking events are the same for both services. For information about migrating from IBM Cloud Activity Tracker to IBM Cloud Logs and running the services in parallel, see migration planning.

Locations where activity tracking events are generated

Locations where activity tracking events are sent to IBM Cloud Activity Tracker hosted event search

Cloud Databases send activity tracking events to IBM Cloud Activity Tracker hosted event search in the regions that are indicated in the following table.

Regions where activity tracking events are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
Yes	Yes	Yes	Yes

Regions where activity tracking events are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
Yes	Yes	No	Yes

Regions where activity tracking events are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)	Paris (`eu-par01`)
Yes	Yes	No	No

Locations where activity tracking events are sent by IBM Cloud Activity Tracker Event Routing

Cloud Databases sends activity tracking events by IBM Cloud Activity Tracker Event Routing in the regions that are indicated in the following table.

Regions where activity tracking events are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
Yes	Yes	Yes	Yes

Regions where activity tracking events are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
Yes	Yes	Yes	Yes

Regions where activity tracking events are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)	Paris (`eu-par01`)
Yes	Yes	Yes	No

Enabling activity tracking events for Cloud Databases

Create an IBM Cloud Logs instance and configure IBM Cloud Activity Tracker Event Routing by setting the routing rule between the Cloud Databases instance and the IBM Cloud Logs target instance.

Viewing activity tracking events for Cloud Databases

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

Launching IBM Cloud Logs from the Cloud Databases dashboard

You can visit the Cloud Databases instance. Click on Overview and scroll to the Observability section. Click on IBM Cloud Logs to view your logging instances. Click on Open Dashboard to access the logs.

Launching IBM Cloud Logs from the Observability page

For information on launching the IBM Cloud Logs UI, see Launching the UI in the IBM Cloud Logs documentation.

List of platform events

The following table lists the activity tracking event actions that Cloud Databases and IBM Cloud generate.

List of events and event descriptions by Cloud Databases
Action name	Legacy action name	Description
`<service_name>.deployment-backup.create`	`<service_id>.backup-ondemand.create`	An on-demand backup of your instance was created. If the backup failed, a "-failure" flag is included in the message.
`<service_name>.deployment-backup-scheduled.create`	`<service_id>.backup-scheduled.create`	A scheduled backup of your instance was created. If the backup failed, a "-failure" flag is included in the message.
`<service_name>.deployment-user.update`	`<service_id>.user-password.update`	A user's password was updated. A "-failure" flag is included in the message if the attempt to update a user's password failed.
`<service_name>.deployment-user.create`	`<service_id>.user.create`	A user was created. A "-failure" flag is included in the message if the attempt to create a user failed.
`<service_name>.deployment-user.delete`	`<service_id>.user.delete`	A user was deleted. A "-failure" flag is included in the message if the attempt to delete a user failed.
`<service_name>.deployment-group.update`	`<service_id>.resources.scale`	A scaling operation was performed. If the scaling operation failed, a "-failure" flag is included in the message.
`<service_name>.deployment-allowlist-ip-addresses.update`	`<service_id>.whitelisted-ips-list.update`	The allowlist was modified. A "-failure" flag is included in the message if the attempt to modify the allowlist failed.
`<service_name>.deployment.update`	`<service_id>.serviceendpoints.update`	A change was made to the service endpoints configuration. If the operation failed, a "-failure" flag is included in the message.
`<service_name>.deployment-group-autoscaling.update`	`<service_id>.autoscaling.update`	An autoscaling configuration change or an autoscaling operation was performed. If an autoscaling operation was performed the message includes `autoscale resources for instance <deployment-id>`. If the autoscaling operation or the configuration change failed, a "-failure" flag is included in the message.
`<service_name>.deployment-volumes.update`	`<service_id>.volumes.update`	An activity was performed on the encryption key that is used by the database, such as rotation or shredding. Details of the action are in the event.

The service_name field indicates the type of Cloud Databases instance. For example, databases-for-postgresql or messages-for-rabbitmq.

Auditing of global events, such as <service_name>.instance.create, is covered by the IBM Cloud global event. For more resource-related global events, see Auditing events for service instances.