Skip to main content

FAQ on Audit Logs

Last update:

Why don't I see some events?

The Audit Logs service is under active development. Currently, not all products and event types are displayed in audit logs — we are adding them gradually.

Why don't I see some fields in the logs?

Some fields in the event structure are optional and may not be filled in by some services. If information is missing in these fields, they are not displayed in events.

What does "subject_id": "undefined" mean?

это значит, что не удалось получить значение идентификатора субъекта события из-за сбоя or внутреннего устройства сервисов-источников событий. для таких ситуаций используются зарезервированные значения.

In some events, detailed information about the subject is provided in a paired authentication event. In it, events with the type iam.account.init_action are linked to the main event via the request_id field. These events include:

  • in the iam service — events related to the account and users;
  • in the biling service — events related to financial signals of the cloud platform and deferred payment.

How can I identify a user?

By the value of the subject_id or resource_id field, you can find out the details of the user who is the subject or resource of the logged event — full name, email, phone number (for users with access to the control panel) or the name of a service user.

  1. In the control panel, click IAM in the top menu.
  2. Go to the Users section.
  3. Enter the value of the subject_id or resource_id field for the user from the action log in the search bar.
  4. If the information is not found, go to the Service users section and enter the value in the search bar.
  5. If the information is not found, create a ticket.

How to set up integration with a SIEM system?

You can configure integration using the Audit Logs API of our audit logs service. With it, a SIEM system can regularly download events in JSON or CSV format.

  1. Get an IAM token for your account.

  2. In the SIEM system or via an intermediate script, set up regular API requests for periodic export:

    2.1. Set an interval — for example, every five minutes or every hour.

    2.2. Filter the export by events, services, or projects.

  3. Choose an export format:

    • JSON — recommended for automatic processing;
    • or CSV — for importing into spreadsheet systems.

  4. Set up log sending to a SIEM. The received logs can be sent to a SIEM:

    • through built-in connectors if the SIEM supports ingestion via API or files;
    • syslog agents, if you need to convert logs to the required format;
    • buffers — for example, an intermediate parser or a queue.

How to export the required logs?

You can export logs manually, configure auto-export to an S3 bucket, or configure export via API.

To export only the required events, you can use filters:

  • by date and time (filter available only when exporting via API);
  • by projects;
  • by services, can be viewed in the list of events;
  • by events, can be viewed in the list of events.