---
title: "FAQ on Audit Logs"
sidebar_label: "FAQ"
sidebar_position: 100
description: "Frequently asked questions about the Audit Logs service"
---

import Formbricks from '@theme/MDXComponents/Formbricks'

# FAQ on Audit Logs

## Why don't I see some events? \{#why-dont-i-see-some-events}

The Audit Logs service is under active development. Currently, not all products and [event types](/audit-logs/events.mdx#event-type) are displayed in audit logs — we are adding them gradually.

## Why don't I see some fields in the logs? \{#why-dont-i-see-some-fields}

Some fields in the [event structure](/audit-logs/events.mdx#event-structure) are optional and may not be filled in by some services. If information is missing in these fields, they are not displayed in events.

## What does "subject\_id": "undefined" mean? \{#what-does-subject-id-undefined-mean}

это значит, что не удалось получить значение идентификатора субъекта события из-за сбоя or внутреннего устройства сервисов-источников событий. для таких ситуаций используются [зарезервированные значения](/audit-logs/events.mdx#reserved-values).

In some events, detailed information about the subject is provided in a paired authentication event. In it, events with the type `iam.account.init_action` are linked to the main event via the `request_id` field. These events include:

* in the [iam](/audit-logs/events.mdx#iam) service — events related to the account and users;
* in the [biling](/audit-logs/events.mdx#billing) service — events related to financial signals of the cloud platform and deferred payment.

## How can I identify a user? \{#how-to-identify-user}

By the value of the `subject_id` or `resource_id` field, you can find out the details of the user who is the subject or resource of the logged event — full name, email, phone number (for [users](/access-control/user-types.mdx#users) with access to the control panel) or the name of a [service user](/access-control/user-types.mdx#service-users).

1. In the [control panel](https://my.selectel.ru/iam/users), click **IAM** in the top menu.
2. Go to the **Users** section.
3. Enter the value of the `subject_id` or `resource_id` field for the user from the action log in the search bar.
4. If the information is not found, go to the **Service users** section and enter the value in the search bar.
5. If the information is not found, [create a ticket](https://my.selectel.ru/tickets/create/).

## How to set up integration with a SIEM system? \{#how-to-set-up-integration-with-siem}

You can configure integration using the [Audit Logs API](/api/audit-logs/) of our audit logs service. With it, a SIEM system can regularly download events in JSON or CSV format.

1. [Get an IAM token for your account](/api/authorization/#iam-token-account-scoped).

2. In the SIEM system or via an intermediate script, set up regular API requests for periodic export:

   2.1. Set an interval — for example, every five minutes or every hour.

   2.2. Filter the export by events, services, or projects.

3. Choose an export format:

   * JSON — recommended for automatic processing;
   * or CSV — for importing into spreadsheet systems.

4. Set up log sending to a SIEM. The received logs can be sent to a SIEM:

   * through built-in connectors if the SIEM supports ingestion via API or files;
   * syslog agents, if you need to convert logs to the required format;
   * buffers — for example, an intermediate parser or a queue.

## How to export the required logs? \{#how-to-limit-logs-when-unloading}

You can [export logs manually](/audit-logs/export-logs/export-logs-manually.mdx), [configure auto-export to an S3 bucket](/audit-logs/export-logs/export-logs-to-s3.mdx), or [configure export via API](/audit-logs/export-logs/export-logs-via-api-script.mdx).

To export only the required events, you can use filters:

* by date and time (filter available only when exporting via API);
* by projects;
* by services, can be viewed in the [list of events](/audit-logs/events.mdx#event-type);
* by events, can be viewed in the [list of events](/audit-logs/events.mdx#event-type).

<Formbricks />