Include your activity tracking events file in an Observability topic group in the How to nav group in your toc.yaml file.
Activity tracking events for Event Notifications
IBM Cloud services, such as Event Notifications, generate activity tracking events.
Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.
You can use IBM Cloud Activity Tracker Event Routing, a platform service, to route auditing events in your account to destinations of your choice by configuring targets and routes that define where activity tracking events are sent. For more information, see About IBM Cloud Activity Tracker Event Routing.
You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.
As of 28 March 2024, the IBM Cloud Activity Tracker service is deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs before 30 March 2025. During the migration period, customers can use IBM Cloud Activity Tracker along with IBM Cloud Logs. Activity tracking events are the same for both services. For information about migrating from IBM Cloud Activity Tracker to IBM Cloud Logs and running the services in parallel, see migration planning.
Locations where activity tracking events are generated
Locations where activity tracking events are sent to IBM Cloud Activity Tracker hosted event search
Event Notifications sends activity tracking events to IBM Cloud Activity Tracker hosted event search in the regions that are indicated in the following table.
Dallas (us-south) |
Washington (us-east) |
Toronto (ca-tor) |
Sao Paulo (br-sao) |
|---|---|---|---|
| Yes | No | Yes | No |
Tokyo (jp-tok) |
Sydney (au-syd) |
Osaka (jp-osa) |
Chennai (in-che) |
|---|---|---|---|
| Yes | Yes | Yes | No |
Frankfurt (eu-de) |
London (eu-gb) |
Madrid (eu-es) |
|---|---|---|
| Yes | Yes | Yes |
Locations where activity tracking events are sent by IBM Cloud Activity Tracker Event Routing
Event Notifications sends activity tracking events by IBM Cloud Activity Tracker Event Routing in the regions that are indicated in the following table.
Dallas (us-south) |
Washington (us-east) |
Toronto (ca-tor) |
Sao Paulo (br-sao) |
|---|---|---|---|
| Yes | No | Yes | No |
Tokyo (jp-tok) |
Sydney (au-syd) |
Osaka (jp-osa) |
Chennai (in-che) |
|---|---|---|---|
| Yes | Yes | Yes | No |
Frankfurt (eu-de) |
London (eu-gb) |
Madrid (eu-es) |
|---|---|---|
| Yes | Yes | Yes |
Enabling activity tracking events for Event Notifications
As a security officer, auditor, or manager, you can use the IBM Cloud Activity Tracker service to track how users and applications interact with the Event Notifications service in IBM Cloud.
IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. Use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. You are also alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) Standard. For more information, see the getting started tutorial for IBM Cloud Activity Tracker.
Viewing activity tracking events for Event Notifications
You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.
Launching IBM Cloud Logs from the Event Notifications dashboard
Launching IBM Cloud Logs from the Observability page
For information on launching the IBM Cloud Logs UI, see Launching the UI in the IBM Cloud Logs documentation.
List of platform events
The following table lists the activity tracking event actions that the IBM Cloud platform generates Event Notifications instances are processed.
| Action | Description |
|---|---|
event-notifications.instance.create |
An event is generated when you provision a service instance. |
event-notifications.instance.update |
An event is generated when you rename a service instance or when you change the service plan. |
event-notifications.instance.delete |
An event is generated when a service instance is deleted. |
event-notifications.instance.schedule_reclaim |
An event is generated when a service instance is pending_reclamation. |
event-notifications.instance.restore |
An event is generated when a service instance is restored. |
The following table lists the actions that generate an event for managing service credentials that are associated with a service instance.
| Action | Description |
|---|---|
event-notifications.key.create |
An event is generated when an API key is created for a service instance through the Service credentials section of the service instance UI. |
event-notifications.key.delete |
An event is generated when an API key that is associated with a service instance is deleted from the Service credentials section of the service instance UI. |
List of management events
| Action | Description |
|---|---|
event-notifications.topics.read |
An event is generated when a topic is retrieved. |
event-notifications.topics.create |
An event is generated when a topic is created. |
event-notifications.topics.list |
An event is generated when you retrieve a list of topics. |
event-notifications.topics.update |
An event is generated when you update a topic. |
event-notifications.topics.delete |
An event is generated when you delete a topic. |
event-notifications.destinations.read |
An event is generated when you retrieve a destination. |
event-notifications.destinations.create |
An event is generated when you create a destination. |
event-notifications.destinations.list |
An event is generated when you retrieve the list of destinations. |
event-notifications.destinations.update |
An event is generated when you update a destination. |
event-notifications.destinations.delete |
An event is generated when you delete a destination. |
event-notifications.sources.read |
An event is generated when you retrieve a source. |
event-notifications.sources.create |
An event is generated when you create a source. |
event-notifications.sources.list |
An event is generated when you retrieve the list of sources. |
event-notifications.sources.update |
An event is generated when you update a source. |
event-notifications.sources.delete |
An event is generated when you delete a source. |
event-notifications.subscriptions.read |
An event is generated when you retrieve a subscription. |
event-notifications.subscriptions.create |
An event is generated when you create a subscription. |
event-notifications.subscriptions.list |
An event is generated when you retrieved the list of subscriptions. |
event-notifications.subscriptions.update |
An event is generated when you update a subscription. |
event-notifications.subscriptions.delete |
An event is generated when you delete a subscription. |
event-notifications.smtp_ibm.invite |
An event is generated when an invite is sent for Email subscription. |
event-notifications.sms_ibm.invite |
An event is generated when an invite is sent for SMS subscription. |
event-notifications.integrations.list |
List all the Key Management Services integrations. |
event-notifications.integrations.read |
Get a single Key Management Services integration. |
event-notifications.integrations.update |
Update an existing Key Management Services integration. |
event-notifications.pre-prod-destination-billing.set |
Set the billing unit for pre-prod destination after crossing the usage in the current unit. |
event-notifications.templates.create |
An event is generated when you create a template. |
event-notifications.templates.list |
An event is generated when you retrieve the list of templates. |
event-notifications.templates.update |
An event is generated when you update a template. |
event-notifications.templates.delete |
An event is generated when you delete a template. |
event-notifications.templates.read |
An event is generated when you get details of a template. |
Viewing events
Events that are generated by Event Notifications are automatically forwarded to the IBM Cloud Activity Tracker service instance available in the same location.
IBM Cloud Activity Tracker can have only one instance per location. To view events, you must access the web UI of the IBM Cloud Activity Tracker service in the same location where your service instance is available.
- Create a service instance of IBM Cloud Activity Tracker.
- Start the IBM Cloud Activity Tracker web console to access your events.
Event Notifications resources that are deleted or updated as a result of user actions
Deleting some Event Notifications resources causes associated resources to get deleted. A list of all such actions is as follows:
| EN-resource | Action | Associated resource | Comments |
|---|---|---|---|
| Source | DELETE | Topics | Topics are updated and filters configured on them deleted. |
| Destination | DELETE | Subscription | All subscriptions that are associated with the deleted destination are deleted |
| Topic | DELETE | Subscription | All subscriptions that are associated with the deleted topic are deleted. |