Audit log

Every change made through G8 is written to an audit log: who did what, to which object, when, and with what result. Sign-ins and the daily deletion of old request records are written there too.

Who may open it

The Audit log of an environment needs the view permission of Audit log in that environment (audit.view). The Environment administrator holds it, and a custom role can carry it. The Platform audit log needs the permission to view the platform audit log (platform_audit.view), which only the Platform administrator holds.

An Editor or a Viewer does not see the audit log in the menu. Opening it by address shows a page that names their role and says who may open the log.

Two logs

Log	Where	What it holds
Audit log	In the menu under Audit log, in each environment	Every change to the gateway objects of that environment, and every change to the environment itself.
Platform audit log	Under Platform audit log	Everything, across environments: users, roles, the directory, environments, sign-ins, and the rows of every environment with an Environment column.

A change to the environment itself belongs to that environment, so it shows in both logs. That covers its settings, its protection and every connection test of a saved environment. A connection test made in the form that adds an environment shows in the platform log only, because the environment does not exist yet.

The audit log of an environment: the filter bar, the time presets and the table of events with actor, action, target and result.

What a row shows

Each row has a Time, an Actor, an Action and a Target. The actor is a local user, an Active Directory user, a service account, or the system.

Some rows are written by the server itself, with the system as their actor and the part of the server that wrote them as their source. A sign-in is one of them, and its row names Sign-in as its source. The directory's own checks name Directory, and the daily cleanup of old rows and request records names Retention.

The result badge says how the action ended.

Badge	Meaning
Success	The change was made.
Denied	The actor's role did not allow it. Nothing changed.
Failed	The change was attempted and failed.
In progress	A change to a gateway object was started less than a minute ago and the gateway has not answered yet.
Outcome unknown	The row was written before the gateway was called, and the completion of the change was never recorded. The gateway may or may not hold the change, so open the object and compare it before repeating the change. When the gateway's answer is lost, the server reads the object back and completes the row as success or failure instead, so a row stays here only when the server itself never completed it.

Open a row for the detail: the Request id, the IP address, the Permission the action needed, and the Related events from the same request. A change shows Before and after, the object before and after. The detail notes: Secrets are masked in the audit log.

Finding a row

Type in the filter box to search by actor, target or name, and narrow by actor, action and result. The time presets are Last hour, Last 24 hours, Last 7 days and Last 30 days. The platform log also filters by environment.

Export

Export CSV downloads the rows the current filter matches as a CSV file. An export stops at a hundred thousand rows; narrow the filter when the log says the match is larger. Every export is itself written to the log.

How long rows are kept

Audit rows are kept for 365 days unless the server is configured otherwise. The number of days is G8_AUDIT_RETENTION_DAYS, an environment variable of the G8 server. There is no setting for it in the console. Removing an environment keeps its audit rows.

Every action

Each row names its action. The platform actions are the server's own catalog, the gateway writes are one per object kind and verb, and the second column is what the console shows for each. Both lists are read from the product when the site is built.

Action	Shown as
auth.login_succeeded	Signed in
auth.login_failed	Sign-in failed
auth.logout	Signed out
auth.lockout	Account locked
auth.password_changed	Password changed
session.revoked	Session revoked
bootstrap.admin_created	First administrator created
user.created	User created
user.updated	User updated
user.disabled	User disabled
user.enabled	User enabled
user.deleted	User deleted
user.password_reset	Password reset
user.provisioned_jit	User provisioned from the directory
assignment.granted	Access granted
assignment.revoked	Access revoked
role.created	Role created
role.updated	Role updated
role.deleted	Role deleted
service_account.created	Service account created
service_account.updated	Service account updated
service_account.disabled	Service account disabled
service_account.enabled	Service account enabled
service_account.deleted	Service account deleted
service_account.token_created	Token created
service_account.token_revoked	Token revoked
environment.protected_changed	Environment protection changed
environment.created	Environment added
environment.updated	Environment updated
environment.deleted	Environment deleted
environment.tested	Connection test
directory.updated	Directory connection updated
directory.test	Directory connection tested
directory.group_mapping_added	Group mapping added
directory.group_mapping_removed	Group mapping removed
directory.membership_resync	Memberships resynced
directory.unreachable	Directory unreachable
access.denied	Access denied
audit.pruned	Audit log pruned
audit.exported	Audit log exported
traffic.retention_changed	Retention of request records changed
traffic.pruned	Request records deleted by retention
traffic.writer_tested	Writer account of request records tested
traffic.exported	Request records exported
traffic.body_viewed	Body of a request record viewed
alert_rule.created	Alert rule created
alert_rule.updated	Alert rule updated
alert_rule.deleted	Alert rule deleted
alert_rule.enabled	Alert rule enabled
alert_rule.disabled	Alert rule disabled
alert_rule.muted	Alert rule muted
alert_rule.unmuted	Alert rule unmuted
alert_channel.created	Alert channel added
alert_channel.updated	Alert channel updated
alert_channel.deleted	Alert channel deleted
alert_channel.tested	Alert channel tested
alert_smtp.updated	Mail relay for alerts saved
alert_smtp.deleted	Mail relay for alerts removed
alert_smtp.tested	Mail relay for alerts tested
alerts.pruned	Alert history deleted by retention

Gateway object	created	updated	deleted
consumer	Consumer created	Consumer updated	Consumer deleted
consumer_group	Consumer group created	Consumer group updated	Consumer group deleted
credential	Credential created	Credential updated	Credential deleted
global_rule	Global rule created	Global rule updated	Global rule deleted
graphql_cost_decoration	Cost decoration created	Cost decoration updated	Cost decoration deleted
plugin_config	Plugin config created	Plugin config updated	Plugin config deleted
plugin_metadata	Environment-wide settings created	Environment-wide settings updated	Environment-wide settings reset
proto	Proto created	Proto updated	Proto deleted
route	Route created	Route updated	Route deleted
secret	Secret created	Secret updated	Secret deleted
service	Service created	Service updated	Service deleted
ssl	Certificate created	Certificate updated	Certificate deleted
stream_route	Stream route created	Stream route updated	Stream route deleted
upstream	Upstream created	Upstream updated	Upstream deleted

Related

• Users, roles and access: the roles that may read each log.
• Environment settings: the rows a change to an environment leaves.
• Request records: what the gateway did with each request, as opposed to what people did in the console.