Skip to main content

FAQ on Audit Logs

Why don't I see some events?

The Audit Logs service is in active development. Currently, not all products and event types are displayed in audit logs — we are adding them gradually.

Why don't I see some fields in the logs?

Some fields in the event structure are optional and may not be filled in by some services. If information is missing in fields, they are not displayed in events.

What does "subject_id": "undefined" mean?

This means that the event subject identifier value could not be retrieved due to a failure or the internal architecture of event source services. For such situations, reserved values are used.

In some events, detailed information about the subject is provided in a paired authentication event. In it, events with the type iam.account.init_action are linked to the main event via the request_id field. Such events include:

  • in the iam service — events with the account, users;
  • in the biling service — events with Cloud Platform financial signals, payment deferral.

How can I identify a user?

Using the value of the subject_id or resource_id field, you can find the details of the user who is the subject or resource of the logged event — full name, email, phone number (for panel users) or the name of a service user.

  1. In the control panel, in the top menu, click IAM.
  2. Go to the Panel users section.
  3. In the search field, enter the value of the user's subject_id or resource_id field from the action log.
  4. If no information is found, go to the Service users section and enter the value in the search field.
  5. If no information is found, create a ticket.

How to set up integration with a SIEM system?

You can set up integration using the Audit Logs API of our Audit Logs service. With it, a SIEM system can regularly download events in JSON or CSV format.

  1. Get an account-scoped IAM token.

  2. In the SIEM system or via an intermediate script, set up regular API requests for periodic export:

    2.1. Set an interval — for example, every five minutes or every hour.

    2.2. Filter the export by events, services, or projects.

  3. Choose an export format:

    • JSON — recommended for automatic processing;
    • or CSV — for importing into spreadsheet systems.

  4. Set up log sending to a SIEM. The received logs can be sent to a SIEM:

    • through built-in connectors if the SIEM supports ingestion via API or files;
    • syslog agents, if you need to convert logs to the required format;
    • buffers — for example, an intermediate parser or a queue.

How to export the required logs?

You can export logs manually, set up automatic export to an S3 bucket, or set up export via API.

To export only the required events, you can use filters:

  • by date and time (filter available only when exporting via API);
  • by projects;
  • by services, can be viewed in the event list;
  • by events, can be viewed in the event list.