Skip to main content

FAQ on Audit Logs

Why don't I see some events?

The Audit Logs service is currently in active development. At the moment, not all products and event types are displayed in audit logs — we are gradually adding them.

Why don't I see some fields in the logs?

Some fields in the event structure are optional and may not be populated by some services. If information is missing in the fields, they are not displayed in the events.

What does "subject_id": "undefined" mean?

This means that the subject identifier value could not be retrieved due to a failure or the internal design of the event-source services. For such situations, reserved values are used.

In some events, detailed information about the subject is provided in a paired authentication event. In this case, events with the iam.account.init_action type are linked to the main event via the request_id field. Such events include:

  • in the iam service — events related to the account and users;
  • in the biling service — events related to financial signals of the cloud platform and deferred payment.

How can I identify a user?

By the value of the subject_id or resource_id field, you can find out the details of the user who is the subject or resource of the logged event—full name, email, phone number (for panel users) or the name of the service user.

  1. In the control panel, click IAM in the top menu.
  2. Go to the Panel Users section.
  3. Enter the value of the subject_id or resource_id field for the user from the action log in the search bar.
  4. If the information is not found, go to the Service users section and enter the value in the search bar.
  5. If the information is not found, create a ticket.

How to set up integration with a SIEM system?

You can configure integration using the Audit Logs API of our audit logs service. With it, a SIEM system can regularly download events in JSON or CSV format.

  1. Get an IAM token for your account.

  2. In the SIEM system or via an intermediate script, set up regular API requests for periodic export:

    2.1. Set an interval — for example, every five minutes or every hour.

    2.2. Filter the export by events, services, or projects.

  3. Choose an export format:

    • JSON — recommended for automatic processing;
    • or CSV — for importing into spreadsheet systems.

  4. Set up log sending to a SIEM. The received logs can be sent to a SIEM:

    • through built-in connectors if the SIEM supports ingestion via API or files;
    • syslog agents, if you need to convert logs to the required format;
    • buffers — for example, an intermediate parser or a queue.

How to export the required logs?

You can export logs manually, configure auto-export to an S3 bucket, or configure export via API.

To export only the required events, you can use filters:

  • by date and time (filter available only when exporting via API);
  • by projects;
  • by services, can be viewed in the list of events;
  • by events, can be viewed in the list of events.