{:external: target="_blank" .external} {:shortdesc: .shortdesc} {:codeblock: .codeblock} {:pre: .pre} {:screen: .screen} {:tsSymptoms: .tsSymptoms} {:tsCauses: .tsCauses} {:tsResolve: .tsResolve} {:tip: .tip} {:important: .important} {:note: .note} {:download: .download} {:table: .aria-labeledby="caption"} {:java: .ph data-hd-programlang='java'} {:ruby: .ph data-hd-programlang='ruby'} {:c#: .ph data-hd-programlang='c#'} {:objectc: .ph data-hd-programlang='Objective C'} {:python: .ph data-hd-programlang='python'} {:javascript: .ph data-hd-programlang='javascript'} {:php: .ph data-hd-programlang='PHP'} {:swift: .ph data-hd-programlang='swift'} {:reactnative: .ph data-hd-programlang='React Native'} {:csharp: .ph data-hd-programlang='csharp'} {:ios: .ph data-hd-programlang='iOS'} {:android: .ph data-hd-programlang='Android'} {:cordova: .ph data-hd-programlang='Cordova'} {:xml: .ph data-hd-programlang='xml'}

{: #at_events}

As a security officer, auditor, or manager, use the Activity Tracker service to track how users and applications interact with the {{site.data.keyword.mobilepushshort}} service in {{site.data.keyword.cloud}}. You can manage, view, and audit actions or events such as device registration, device subscription, and application configuration can be tracked for {{site.data.keyword.mobilepushshort}} service. {: shortdesc}

{{site.data.keyword.at_full_notm}} records user-initiated activities that change the state of a service in {{site.data.keyword.cloud_notm}}. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the getting started tutorial for {{site.data.keyword.at_full_notm}}.

{: at-prerequisite}

You need to have an instance of {{site.data.keyword.at_full_notm}} in the region where you would like to track events.

To view and search for the event logs, use any one of the {{site.data.keyword.at_full_notm}} plans (7 or 14 or 30 days) based on your log search need. Using {{site.data.keyword.at_full_notm}} lite plan is not recommended for event logging. {: important}

{: #at_actions}

The following table lists the {{site.data.keyword.cloudaccesstrailfull}} events for {{site.data.keyword.cloud_notm}} {{site.data.keyword.mobilepushshort}} service:

Currently, the {{site.data.keyword.cloudaccesstrailshort}} Events for {{site.data.keyword.cloud_notm}} {{site.data.keyword.mobilepushshort}} service are available only on Dallas, Washington DC, London, Sydney, and Tokyo. {: note}

{: #at_ui}

Events that are generated by an instance of the {{site.data.keyword.mobilepushshort}} service are automatically forwarded to the {{site.data.keyword.at_full_notm}} service instance that is available in the same location.

{{site.data.keyword.mobilepushshort}} service manages Activity Tracker by using the same common Dallas instance for Washington DC and Dallas and use tags that let events filter based on region. {: note}

{{site.data.keyword.at_full_notm}} can have only one instance per location. To view events, you must access the web UI of the {{site.data.keyword.at_full_notm}} service in the same location where your service instance is available. For more information, see Launching the web UI through the IBM Cloud UI.

{: #at_events_iam_analyze}

{{site.data.keyword.at_full_notm}} compiles all of your logs at an account level, which means that all of your services are shown in the same instance, per region. If you have an app that runs in Dallas and another app that runs in London, the events are found in the respective instances of Activity Tracker.

1. Log in to your IBM Cloud account.

2. In the IBM Cloud console navigation, click Observability.

3. Select Activity Tracker from the Observability navigation.

4. Select the instance of Activity Tracker that correlates to the region for which you want to see events.

5. Click Open Dashboard. When the dashboard loads, you see an overview of all of the activity that is covered by that instance of {{site.data.keyword.at_full_notm}}. You can use the search operators to filter the events by tags, sources, apps, or levels. You can also search for specific events or jump to a specific timeframe.

6. To see events for Push Notification Service select imfpush from the All Sources drop-down. To help meet compliance regulations, you can choose to retain your events or archive them into IBM Cloud Object Storage.

7. For update events user can use intialValue and newValue provided as part of requestData to check the delta. However if the information is confidential newValue will contain uniqueId of the resource, user can use newValue and applicationId provided as part of requestData to cross check the delta.

   

   Figure 1: View of your Activity Tracker instance with a sample audit event.