Skip to main content

FAQ on Audit Logs

Why don't I see some events?

The Audit Logs service is in active development. Currently, not all products and event types are displayed in audit logs — we are adding them gradually.

Why don't I see some fields in the logs?

Some fields in the event structure are optional and may not be filled in by some services. If information is missing in fields, they are not displayed in events.

What does "subject_id": "undefined" mean?

This means that the event subject identifier value could not be retrieved due to a failure or the internal architecture of event source services. For such situations, reserved values are used.

In some events, detailed information about the subject is provided in a paired authentication event. In it, events with the type iam.account.init_action are linked to the main event via the request_id field. Such events include:

  • in the iam service — events with the account, users;
  • in the biling service — events with Cloud Platform financial signals, payment deferral.

How can I identify a user?

You can identify a user by the value of the subject_id or resource_id field in an event.

For more information on how to identify a user from logs, see the Identify a user guide in the documentation.

How to set up integration with a SIEM system?

You can set up integration using the Audit Logs API of our audit logs service. With it, the SIEM system can regularly download events in JSON or CSV format.

  1. Get an IAM token for the account.

  2. In the SIEM system or via an intermediate script, set up regular requests to the API for periodic export:

    2.1. Set an interval — for example, once every five minutes or hour.

    2.2. Filter the export by events, services, or projects.

  3. Select the export format:

    • JSON — recommended for automated processing;
    • or CSV — for import into spreadsheet systems.

  4. Set up log forwarding to SIEM. The received logs can be forwarded to SIEM:

    • via built-in connectors if the SIEM supports API or file ingestion;
    • syslog agents if you need to convert logs into the required format;
    • buffers — for example, an intermediate parser or queue.

How to export the required logs?

You can export logs manually, set up automatic export to an S3 bucket, or set up export via API.

To export only the required events, you can use filters:

  • by date and time (the filter is available only when exporting via API);
  • by projects;
  • by services, can be viewed in the event list;
  • by events, can be viewed in the event list.