Activity tracking events for IBM Cloud Direct Link

IBM Cloud services, such as IBM Cloud Direct Link, generate activity tracking events.

Activity tracking events report on activities that change the state of a service in IBM Cloud. You can use the events to investigate abnormal activity and critical actions and to comply with regulatory audit requirements.

You can use IBM Cloud Activity Tracker Event Routing, a platform service, to route auditing events in your account to destinations of your choice by configuring targets and routes that define where activity tracking events are sent. For more information, see About IBM Cloud Activity Tracker Event Routing.

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

As of 28 March 2024, the IBM Cloud Activity Tracker service is deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs before 30 March 2025. During the migration period, customers can use IBM Cloud Activity Tracker along with IBM Cloud Logs. Activity tracking events are the same for both services. For information about migrating from IBM Cloud Activity Tracker to IBM Cloud Logs and running the services in parallel, see migration planning.

Activity tracker events are captured for all locations, even if recorded in eu-de. Because Direct Link is a global control plan, if you perform an action to a resource in us-south, it's handled by that control plane and logged in the us-south activity tracker location (by default).

Locations where activity tracking events are generated

Direct Link is a global service, and can generate activity tracking events in all regions.

Locations where activity tracking events are sent to IBM Cloud Activity Tracker hosted event search

IBM Cloud Direct Link sends activity tracking events to IBM Cloud Activity Tracker hosted event search in the regions that are indicated in the following table.

Regions where activity tracking events are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
No	No	No	No

Regions where activity tracking events are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
No	No	No	No

Regions where activity tracking events are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)
Yes	No	No

Locations where activity tracking events are sent by IBM Cloud Activity Tracker Event Routing

IBM Cloud Direct Link sends activity tracking events by IBM Cloud Activity Tracker Event Routing in the regions that are indicated in the following table.

Regions where activity tracking events are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
No	No	No	No

Regions where activity tracking events are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
No	No	No	No

Regions where activity tracking events are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)
Yes	No	No

Viewing activity tracking events for IBM Cloud Direct Link

You can use IBM Cloud Logs to visualize and alert on events that are generated in your account and routed by IBM Cloud Activity Tracker Event Routing to an IBM Cloud Logs instance.

Launching IBM Cloud Logs from the Observability page

For information on launching the IBM Cloud Logs UI, see Launching the UI in the IBM Cloud Logs documentation.

List of management events

The following table lists actions that generate management events.

Actions that generate management events
Action	Description
`directlink.dedicated.gateway.create`	A Dedicated gateway was created.
`directlink.dedicated.gateway.delete`	A Dedicated gateway was deleted.
`directlink.dedicated.gateway.update`	A Dedicated gateway was updated.
`directlink.dedicated.completion-notice.create`	A Dedicated completion notice was created.
`directlink.dedicated.completion-notice.read`	A Dedicated completion notice was retrieved.
`directlink.gateway.route-report.create`	A route report was created.
`directlink.gateway.route-report.delete`	A route report was deleted.
`directlink.dedicated.virtual-connection.create`	A Dedicated virtual connection was created.
`directlink.dedicated.virtual-connection.delete`	A Dedicated virtual connection was deleted.
`directlink.dedicated.virtual-connection.update`	A Dedicated virtual connection was updated.
`directlink.connect.gateway.create`	A Connect gateway was retrieved.
`directlink.connect.gateway.delete`	A Connect gateway was deleted.
`directlink.connect.gateway.update`	A Connect gateway was updated.
`directlink.connect.gateway.action`	A Connect gateway action was applied.
`directlink.gateway.route-report.create`	A route report was created.
`directlink.gateway.route-report.delete`	A route report was deleted.
`directlink.connect.virtual-connection.create`	A Connect virtual connection was created.
`directlink.connect.virtual-connection.delete`	A Connect virtual connection was deleted.
`directlink.connect.virtual-connection.update`	A Connect virtual connection was updated.

List of data events

Actions that generate data events
Action	Description
`directlink.dedicated.gateway.read`	A Dedicated gateway was retrieved.
`directlink.gateway.list`	Dedicated and Connect gateways were listed.
`directlink.gateway.route-report.read`	A route report was retrieved.
`directlink.gateway.route-report.list`	A route report was listed.
`directlink.dedicated.virtual-connection.read`	A Dedicated virtual connection was retrieved.
`directlink.dedicated.virtual-connection.list`	A Dedicated gateway's virtual connections were listed.
`directlink.connect.gateway.read`	A Connect gateway was retrieved.
`directlink.gateway.list`	Dedicated and Connect gateways were listed.
`directlink.gateway.route-report.read`	A route report was retrieved.
`directlink.gateway.route-report.list`	A route reports were listed.
`directlink.connect.virtual-connection.list`	A Connect virtual connections were listed.
`directlink.connect.virtual-connection.read`	A Connect virtual connection was retrieved.

Analyzing IBM Cloud Direct Link activity tracking events

Refer to the following information when analyzing events:

Use the search bar to search for action:directlink.connect.virtual-connection to get the list of events related to Direct Link Connect, or action:directlink.dedicated.virtual-connection to get events that are related to Direct Link Dedicated.
The target field identifies the direct link that is associated with an event. When the gateway exists in a different account or there is no gateway that is associated with the request, the target is set as crn:v1:bluemix:public:directlink:global:a/<your account ID>:::. Events that do not correspond to a gateway don't have resource group information. For more information about cross-account gateway connections, see Adding a cross-account (VPC only) connection.
Events that report update actions do not include information about the delta of the change.
The event's initiator field contains information about who initiated each request. In authorized cross-account scenarios, IBM is identified as the initiator.
The name of the service in IBM Cloud is directlink.connect; therefore, all AT events have an action formatted as <svcname>.<object>.<action>, where svcname can be directlink.connect or directlink.dedicated.