When you enable CTS for the first time, a management tracker named system is created. You can also create multiple data trackers on the Tracker List page. The management tracker identifies and associates with all cloud services your tenant account is using, and records all operations of your tenant account. Data trackers record details of the tenant's operations on data in Object Storage Service (OBS) buckets.

Once enabled, CTS starts recording operations on cloud resources and data in OBS buckets. CTS retains operation records for seven days.

CTS periodically transfers trace files to OBS buckets for storage. A trace file is a collection of traces. CTS generates trace files by service and transfer cycle, and adjusts the number of traces contained in each trace file as needed.

You can configure CTS to send notifications for key events such as:

Real-time detection of high-risk operations (such as VM restart and security configuration changes), cost-sensitive operations (such as creating and deleting expensive resources), and service-sensitive operations (such as network configuration changes).

Detection of operations such as login of users with admin-level permissions or operations performed by users without the required permissions.