how do I know a change happens on the security group with no luck to find it in cloud trail?

You can check the events of a security group by following the methods in the following document.
https://repost.aws/knowledge-center/cloudtrail-event-history-changed

By the way, what configuration changes did you make?