Activity Tracker events
As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to track how users and applications interact with virtual server instances in IBM Cloud®. The account owner and users that are linked with the account can trigger virtual server events that are logged in Activity Tracker.
The Activity Tracker service records user-initiated activities that change the state of a service in IBM Cloud. For more information, see Auditing events for IAM.
To get started with monitoring your user's actions, see Getting started with IBM Cloud Activity Tracker.
An initiator can be a user, a service, or an application. For a user to generate events, the user must have access to Infrastructure resources in IBM Cloud® console.
Virtual server instance events
You can audit a virtual server instance through its lifecycle by using the Activity Tracker service.
The following table lists the actions that generate an event:
| Action | Description |
|---|---|
audit-log.vsi.provision |
An event is generated when an initiator provisions an instance. |
audit-log.vsi-port.disable |
An event is generated when an initiator disables a port in an instance. |
audit-log.vsi-port.enable |
An event is generated when an initiator enables a port in an instance. |
audit-log.vsi-port-speed.update |
An event is generated when an initiator updates the port speed in an instance. |
audit-log.vsi-image-template.create |
An event is generated when an initiator creates an image template for an instance. |
audit-log.vsi.power-off |
An event is generated when an initiator powers off an instance. |
audit-log.vsi.soft-power-off |
An event is generated when an initiator does a soft power off on an instance. |
audit-log.vsi.force-power-off |
An event is generated when an initiator does a force power off on an instance. |
audit-log.vsi.reboot |
An event is generated when an initiator reboots an instance. |
audit-log.vsi.soft-reboot |
An event is generated when an initiator does a soft reboot on an instance. |
audit-log.vsi.hard-reboot |
An event is generated when an initiator does a hard reboot on an instance. |
audit-log.vsi.power-on |
An event is generated when an initiator powers on an instance. |
audit-log.vsi.rename |
An event is generated when an initiator renames an instance. |
audit-log.vsi.rescue |
An event is generated when an initiator rescues an instance. |
audit-log.vsi-security-group.add |
An event is generated when an initiator adds a security group to an instance. |
audit-log.vsi-security-group.remove |
An event is generated when an initiator removes a security group from an instance. |
audit-log.vsi.reload |
An event is generated when an initiator performs an operating system (OS) reload for an instance. |
audit-log.vsi.boot |
An event is generated when an initiator boots an instance from an image. |
audit-log.vsi.reclaim |
An event is generated when an initiator cancels an instance. |
audit-log.vsi.pause |
An event is generated when an initiator pauses an instance. |
Viewing events
The Activity Tracker events are available in the Activity Tracker account domain that is available in the IBM Cloud region where the events are generated. For more information, see Viewing account events.
Activity Tracker events are automatically forwarded to the Activity Tracker service in the same region where the action happens.