vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Activity Tracker events 

Use the IBM Cloud® Activity Tracker service to track how users and applications interact with IBM Cloud Object Storage (COS).

This feature is not currently supported in Object Storage for Satellite. [Learn more.](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cos-satellite)

The IBM Cloud Activity Tracker service records user-initiated activities that change the state of a service in IBM Cloud. For more information, see [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

By default, COS events that report on global actions such as creation of a bucket are collected automatically. You can monitor global actions through the Activity Tracker instance that is located in the Frankfurt location.

In IBM Cloud Object Storage, you can also monitor management events and COS data events.



* Collection of these events in your account is optional.
* You must configure each bucket to enable management events, or management and data events. Notice that you cannot enable data events only for a bucket.
* To monitor management events, you must configure a bucket and specify the Activity Tracker instance where those events will be collected and forwarded.
* To monitor data events, you must select the option Track data events.
* Each action that a user performs on a COS resource has a unique ID that is included in the event in the responseData.requestId field.



You can use this service to investigate abnormal activity and critical actions, and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.



 Management events 

Management events are classified in the following categories:



* Global events
* Resource configuration events
* Bucket events
* Object events





 Global events 

The following table lists the COS actions that generate a global event. You can monitor this events through the Activity Tracker instance that is available in the Frankfurt location.



Table 1. Object Storage actions that generate global events

 Action Description
Activity tracking integration 

IBM Cloud® Schematics integrates to fully manage enterprise-grade IBM Cloud Activity Tracker that enables supervision, compliance, and audits the operations and risk to manage your IBM Cloud. This feature includes live logs, custom views, and alert of the Schematics Workspaces by connecting, configuring, and view through observability dashboards.



  Launching activity tracking 

Use the add audit UI to generate and maintain an audit trail for a Schematics Workspaces instance events, access, events, and access audit log. Use the audit log to reveal usage instance that would identify workspace misuse, and you can act to eliminate such misuse. You can choose the log retention log day as 7,14,or 30 days and have the ability to archive to IBM Cloud Object Storage to retain your logs. Complete these steps to launch Activity Tracker.



1.  Log in to your [IBM Cloud](https://cloud.ibm.com/) account by using your credentials.
2.  From the IBM Cloud page, select Navigation menu > Schematics.
3.  Select Integrations in the side navigation pane.
4.  Against your activity tracking instance, click Configure and select your instance name based on your location.
5.  Click Select.
6.  Select your location and click Connect > Activity tracking. You are redirected to the IBM Cloud Activity Tracker service form to monitor your instance.

In case you are redirected to the [IBM Cloud catalog](https://cloud.ibm.com/catalog) page, search for IBM Cloud Activity Tracker to view the IBM Cloud Activity Tracker service form.
7.  Analyze the configuration and click Create.

If the create is successful you can view logs of your Schematics service instance in the Log Activity Tracker that is configured to receive platform service logs. For more information about viewing Activity Tracker logs, see [Viewing logs](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-at_events).
8.  In the list of instance name, click Configure to view IBM Cloud Activity Tracker page to retrieve the instance summary details.
9.  Click Open Dashboard to track your services.
You can access Activity Tracker with Log Analysis through the Observability tab of your deployment's Manage page. The Manage Activity Tracker button links to the main list of all Activity Tracker instances in your IBM Cloud account. Select the instance where you set your database logs to be forwarded. Click View Activity Tracker to view the events.

After the event activity is forwarded to the service, each event can be expanded to a detailed view by clicking the arrow to the left of the time stamp.

The Log Analysis service offers [searching](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-view_logsview_logs_step6), [filtering](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-view_logsview_logs_step5), and [export](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-exportexport) of events so you can customize retention for your use case. You can also use it to configure [alerts](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-alerts).







 Event fields 

A description of the common fields for an Activity Tracker event is on the [Event fields](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-event) page.





 List of events 

The following table lists the events that get sent to Activity Tracker from Db2 on Cloud deployments:



Table 2. List of events and event descriptions

 Action Description 

 <service_id>.backup-scheduled.create A scheduled backup of your deployment was created. If the backup failed, a "-failure" flag is included in the message. 
 <service_id>.user-password.update A user's password was updated. A "-failure" flag is included in the message if the attempt to update a user's password failed. 
 <service_id>.user.create A user was created. A "-failure" flag is included in the message if the attempt to create a user failed.
However, if you use the same API key to create a token for API calls, like [creating an IAM access token for a user or service ID](https://cloud.ibm.com/apidocs/iam-identity-token-apigettoken-apikey), this does not generate a session.

Users

Trusted profiles - federated users

Service IDs



Table 1. Sessions and refresh token availability - Users
When a session is created or not depends on a combination of the identity type and login type.

 Login type Sessions Refresh tokens 

 IBM Cloud® Console ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/checkmark-icon.svg) 
 IBM Cloud® CLI ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/checkmark-icon.svg) 
 API call
The viewer role on the user management service is a role that is commonly assigned for users assigned a role to view or manage support cases. If an account owner restricts the visibility of the user list in the IAM settings, users can't see support cases that are opened by other users in the account. However, if they are assigned the viewer role for the user management service, the user list visibility setting doesn't affect the ability to view cases in the account.





 Activity Tracker Event Routing 

You can give users access to run platform actions.



Table 21. Roles and example actions for the Activity Tracker Event Routing service

 Roles Actions 

 Viewer View Activity Tracker Event Routing configuration resources such as routes and targets. 
 Operator View Activity Tracker Event Routing configuration resources such as routes and targets. 
 Editor View, create, update, and delete Activity Tracker Event Routing resources. 
 Administrator View, create, update, and delete Activity Tracker Event Routing resources.<br><br>Assign access policies to manage Activity Tracker Event Routing resources to other users in the account.
* CLI
* API







 Managing IBM Cloud Activity Tracker Event Routing hosted event search targets 

You can manage IBM Cloud® Activity Tracker Event Routing hosted event search targets in your account by using the IBM Cloud Activity Tracker Event Routing CLI, the IBM Cloud Activity Tracker Event Routing REST API, and Terraform scripts. A target is a resource where you can collect auditing events.

For more information on IBM Cloud Activity Tracker Event Routing targets, see [Targets](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2).



 IAM Access 

You must grant users IAM permissions to manage targets. For more information, see [Assign access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).

When you define a policy, you can indicate the scope of the permissions. You can choose from granting permissions for a specific region or for the entire account.

Users with regional scope will be limited to access targets in their authorized region.



Table 1. IAM actions and the IAM roles that include them.

 IAM action IAM Policy scope IAM Roles Description 

 atracker.target.read Region Administrator <br>Editor <br>Viewer <br>Operator Read (view) information about a target 
 atracker.target.create Region Administrator <br>Editor Create a target 
 atracker.target.update Region Administrator <br>Editor Update a target 
 atracker.target.delete Region Administrator <br>Editor Delete a target 
 atracker.target.list Account Administrator <br>Editor <br>Viewer <br>Operator List all targets 







 CLI prerequisites 

Before you use the CLI to manage targets, complete the following steps:



1. [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2.
Auditing events for DB2 Warehouse 

As a security officer, auditor, or manager, you can use the IBM Cloud Activity Tracker service to track how users and applications interact with the IBM® Db2® Warehouse on Cloud service in IBM Cloud.

You can provision an instance of IBM® Db2® Warehouse on Cloud through the [IBM Cloud catalog](https://cloud.ibm.com/catalog/db2-warehouse). [Learn more](https://cloud.ibm.com/docs/account?topic=account-iamoverview).

The IBM Cloud Activity Tracker service records user-initiated activities that change the state of a service in IBM Cloud. To get started monitoring your user's actions, see [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-getting-startedgetting-started). An initiator can be a user, a service, or an application.



 Platform events 

The following table lists the actions that generate an event:



Table 1. Actions that generate platform events

 Action Description 

 dashdb.instance.create An event is generated when you provision a service instance. 
 dashdb.instance.update An event is generated when you rename a service instance or when you change the service plan. 
 dashdb.instance.delete An event is generated when a service instance is deleted. 
 dashdb.instance.schedule_reclaim An event is generated when a service instance is pending_reclamation. 
 dashdb.instance.restore An event is generated when a service instance is restored. 



The following table lists the actions that generate an event for managing service credentials that are associated to a service instance:



Table 2. Actions that generate service credentials events

 Action Description 

 service_name.key.create An event is generated when an API key is created for a service instance through the Service credentials section of the service instance UI. 
 service_name.key.delete An event is generated when an API key that is associated with a service instance is deleted from the Service credentials section of the service instance UI. 







 Viewing events 

Events are available in the Frankfurt (eu-de) region.
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 View service instances in the Observability Logging dashboard ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 







 IBM Cloud service roles 

Use the following table to identify the service roles that you can grant a user to run any of the following service actions:



Table 2. IAM service roles and actions

 Actions Manager Standard-Member Reader 

 Configure global settings !
[User management](https://cloud.ibm.com/docs/account?topic=account-iamuserinv) user-management [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_acc_mgt_users) 
 [Provisioning](https://cloud.ibm.com/docs/account?topic=account-manage_resource) provisioning [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_rcat_events_rc) 
 [IBM Cloud® Identity and Access Management](https://cloud.ibm.com/docs/account?topic=account-iamoverview) iam-identity <br>iam-groups <br>iam-am [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_iam) 
 [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started) compliance <br>security-advisor [Location-based events](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-at_events) 
 [Global Search Service](https://cloud.ibm.com/docs/account?topic=account-tag) global-search-tagging [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_acc_mgt_resources) 
 [Catalog Management](https://cloud.ibm.com/docs/account?topic=account-filter-account) globalcatalog-collection [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_catalog_management)
You can use the IBM Cloud Activity Tracker service to track how users and applications interact with IBM Cloud Object Storage (COS). For more information about the auditing events that are generated for a bucket and its objects, see [Activity Tracker events](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-at-events).

To collect auditing events for a bucket, consider the following information:



* Collection of auditing events in your account is optional.
* You must configure each bucket to enable management events, or management and data events. Notice that you cannot enable data events only for a bucket.
* To monitor management events, you must configure a bucket and specify the Activity Tracker instance where those events will be collected and forwarded.
* To monitor data events, you must select the option Track data events. Then, select read, write, or read & write to collect events when an object is uploaded or downloaded from a bucket.



Enable collection of auditing events after you have configured Activity Tracking in the region where the bucket is located.





 Listing objects in a bucket 

You can choose any of the following methods to list objects in a bucket:



* [List objects in a given bucket by using the CLI](https://cloud.ibm.com/docs/cloud-object-storage-cli-plugin?topic=cloud-object-storage-cli-plugin-ic-cos-cliic-list-objects).
* [List objects in a given bucket by using the API](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-list-objects-v2)
* List objects in a given bucket through the IBM Cloud UI.





 List objects in a given bucket through the IBM Cloud UI 

Complete the following steps to list the objects in a bucket through the IBM Cloud UI:



1. From the Navigation menu, select Resource List.
2. Select the IBM Cloud Object Storage instance where the bucket is available.
3. Select Buckets.
4. Select a bucket.
iam-identity.account-serviceid.update An event is generated when an initiator renames a service ID or modifies its description. 
 iam-identity.account-serviceid.delete An event is generated when an initiator deletes a service ID. 







 API key events 

The following table lists the actions that generate an event:



Table 8. Events that are generated for API keys actions

 Action Description 

 iam-identity.user-apikey.create An event is generated when an initiator creates an API key. 
 iam-identity.user-apikey.update An event is generated when an initiator renames an API key or modifies its description. 
 iam-identity.user-apikey.delete An event is generated when an initiator deletes an API key. 
 iam-identity.serviceid-apikey.create An event is generated when an initiator creates an API key for a service ID. 
 iam-identity.serviceid-apikey.delete An event is generated when an initiator deletes an API key for a service ID. 
 iam-identity.serviceid-apikey.update An event is generated when an initiator renames an API key for a service ID or modifies its description. 







 Login and logout events 

The following table lists the actions that generate an event:



Table 9. Events that are generated for user login and logout actions

 Action Description 

 iam-identity.user-apikey.login An event is generated when a user logs in to the IBM Cloud by using an API key. 
 iam-identity.serviceid-apikey.login An event is generated when an initiator logs in to the IBM Cloud by using an API key that is associated with a service ID. 
 iam-identity.user-identitycookie.login This is an event that is generated when an initiator requests an identity cookie to run an action. 
 iam-identity.user-refreshtoken.login This is an event that is generated when the initiator logs in to IBM Cloud, or when an initiator that is already logged in requests a new refresh token to run an action.
Tracking events using IBM Cloud Activity Tracker 

[IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started) allows you to [audit the requests](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-at-events) made against a bucket and the objects it contains.

This feature is not currently supported in Object Storage for Satellite. [Learn more.](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cos-satellite)



 Using the console 

First, make sure that you have a bucket. If not, follow the [getting started tutorial](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) to become familiar with the console.



 Enable activity tracking 



1. From the IBM Cloud [console dashboard](https://cloud.ibm.com/), select Storage to view your resource list.
2. Next, select the service instance with your bucket from within the Storage menu. This takes you to the Object Storage Console.
3. Choose the bucket for which you want to enable logging.
4. Select Configuration from the navigation menu.
5. Navigate to the Activity Tracker tab.
6. Click Create.
7. If you already have an instance of IBM Cloud Activity Tracker, you can select it here. If not, select the appropriate configuration, and click Create.
8. After a few minutes, any activity will be [visible in the web UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-observe).







 Archive events to object storage. 

It is possible to have all data collected in an instance of IBM Cloud Activity Tracker be archived and written to a bucket.
If you already have an instance of IBM Cloud Activity Tracker, you can select it here. If not, select the appropriate configuration, and click Create.
8. After a few minutes, any activity will be [visible in the web UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-observe).







 Archive events to object storage. 

It is possible to have all data collected in an instance of IBM Cloud Activity Tracker be archived and written to a bucket. For more information, [see the Activity Tracker documentation](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-archiving-ov).







 Using an API 

Enabling activity tracking is managed with the [COS Resource Configuration API](https://cloud.ibm.com/apidocs/cos/cos-configuration). This new REST API is used for configuring buckets.
Auditing events for IBM Cloud Metrics Routing 

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker Event Routing service or the Activity Tracker hosted event search service to track how users and applications interact with the IBM Cloud Metrics Routing service in IBM Cloud.

Activity Tracker Event Routing records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.



 Managing auditing events in an IBM Cloud account 

You can manage auditing events in an IBM Cloud account in any of the following ways:



* By configuring Activity Tracker hosted event search in the IBM Cloud account

You can use Activity Tracker hosted event search, an IAM enabled service, to manage auditing events through instances that you provision in each IBM Cloud region where you operate.

Activity Tracker hosted event search routes location-based auditing events to an Activity Tracker instance in the region where they are generated and routes global auditing events to the Activity Tracker Event Routing instance that is provisioned in Frankfurt. For more information about locations where IBM Cloud Metrics Routing generates events, see [Locations of Activity Tracker Event Routing events](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-at_eventsat_events_locations).

For more information about how to configure Activity Tracker hosted event search, see [Getting started with Activity Tracker hosted event search](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).
* By configuring Activity Tracker Event Routing in the IBM Cloud account

You can use Activity Tracker Event Routing, a platform service, to manage auditing events at the account-level by configuring targets and routes that define where auditing data is routed.

Activity Tracker Event Routing routes events based on the location that is specified in the logSourceCRN field included in the event. You can define a target, the resource where events are routed to, in any Activity Tracker Event Routing supported region.