ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: usr / local / jetapps / var / lib / aws / lib / python2.7 / site-packages / awscli / examples / cloudtrail

**To look up events for a trail**

The following ``lookup-events`` command looks up API activity events by the attribute ``EventName``::

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin

Output::

{
    "Events": [
       {
           "EventId": "654ccbc0-ba0d-486a-9076-dbf7274677a7", 
           "Username": "my-session-name", 
           "EventTime": 1453844532.0, 
           "CloudTrailEvent": "{\"eventVersion\":\"1.02\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AROAJIKPFTA72SWU4L7T4:my-session-name\",\"arn\":\"arn:aws:sts::123456789012:assumed-role/my-role/my-session-name\",\"accountId\":\"123456789012\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2016-01-26T21:42:12Z\"},\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AROAJIKPFTA72SWU4L7T4\",\"arn\":\"arn:aws:iam::123456789012:role/my-role\",\"accountId\":\"123456789012\",\"userName\":\"my-role\"}}},\"eventTime\":\"2016-01-26T21:42:12Z\",\"eventSource\":\"signin.amazonaws.com\",\"eventName\":\"ConsoleLogin\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"72.21.198.70\",\"userAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36\",\"requestParameters\":null,\"responseElements\":{\"ConsoleLogin\":\"Success\"},\"additionalEventData\":{\"MobileVersion\":\"No\",\"MFAUsed\":\"No\"},\"eventID\":\"654ccbc0-ba0d-486a-9076-dbf7274677a7\",\"eventType\":\"AwsConsoleSignIn\",\"recipientAccountId\":\"123456789012\"}", 
           "EventName": "ConsoleLogin", 
           "Resources": []
       }
    ]
  }

[-] lookup-events.rst [edit]
[-] create-trail.rst [edit]
[-] add-tags.rst [edit]
[-] create-subscription.rst [edit]
[+] ..
[-] list-tags.rst [edit]
[-] list-public-keys.rst [edit]
[-] validate-logs.rst [edit]
[-] describe-trails.rst [edit]
[-] update-subscription.rst [edit]
[-] get-trail-status.rst [edit]
[-] remove-tags.rst [edit]
[-] delete-trail.rst [edit]
[-] start-logging.rst [edit]
[-] update-trail.rst [edit]
[-] get-event-selectors.rst [edit]
[-] stop-logging.rst [edit]
[-] put-event-selectors.rst [edit]