Audit and activity records
Learn which operations the platform records, what each record contains, who can read the records, and how long the records are kept.
The platform records operations, such as creating, changing, or deleting a resource, and shows them in the Activity log. Each record says who started the operation, when, from which address, and with what result. This article lists the operations that are recorded.
What a record contains
Each record describes one operation:
| Field | Content |
|---|---|
| Time | When the operation was recorded, and when it started and finished. |
| Actor | Who started the operation. A user appears with their name and email address. An operation started with an API token appears with the user who owns the token. A service account appears with its ID. Operations that the platform starts itself appear with an internal name, for example backup-plan-scheduler for scheduled backup runs, or as system. |
| Source address | The IP address that the request came from. Some records have none, for example the operations that the platform starts itself. |
| Action | What was done, for example compute.instance.create. |
| Resource | The kind, ID, and name of the resource. The name is the one that the resource had when the operation started. |
| Result | Success, Failure, or Pending. A canceled operation counts as Failure. A failed operation carries its error. |
For example, if an instance was deleted, filter the records by the action compute.instance.delete, or search for the instance's name, to find who deleted it, when, and from which address.
Which records you see
A project's records include the operations on the project's resources and the operations at the level of the organization and its subscriptions, such as changes to members and role assignments.
To read the records, you need any role with Read access to Audit Log on the project or on its subscription. Of the built-in roles, Owner, Contributor, and Reader have it, and Billing Operator doesn't. An API token also needs the iam:read scope.
What's recorded
The Activity Log records these operations when you start them in the console or through the REST API. Only the operations listed here are recorded.
| Product | Recorded operations |
|---|---|
| Virtual Machines | Creating and deleting instances. Starting, stopping, restarting, pausing, resuming, and resizing them. Attaching and detaching volumes, network interfaces, and security groups. Deleting key pairs. |
| Images and Snapshots | Creating and deleting images and instance restore points. Creating, restoring, and deleting volume snapshots. |
| Block Storage | Creating, changing, cloning, extending, attaching, detaching, and deleting volumes, and changing their type. Accepting a volume transfer. |
| Backup Center | Creating, changing, pausing, resuming, running, and deleting backup plans, including scheduled runs. Assigning and releasing volumes, retrying failed volumes, and restoring. |
| Object Storage | Creating and deleting buckets, changing their visibility and access policy, and adding and removing CORS rules. |
| Virtual Networks | Creating and deleting networks, subnets, routers, and network interfaces. Changing subnets. Setting and clearing a router's external gateway, attaching and detaching router interfaces, and adding and removing static routes. Detaching network interfaces, and allocating Floating IPs for them. |
| Security Groups | Creating and deleting security groups, and adding and removing rules. |
| Floating IPs | Allocating, associating, disassociating, and releasing Floating IPs. |
| Load Balancers | Creating, changing, and deleting load balancers, listeners, pools, members, and health monitors. |
| Site-to-Site VPN | Creating, changing, and deleting VPN services, policies, endpoint groups, and site connections. Disabling, enabling, and restarting site connections. |
| Identity & Access Management | Adding, inviting, deactivating, reactivating, and removing members. Assigning, changing, and removing roles. Creating, changing, cloning, and deleting custom roles. Deactivating, reactivating, and deleting service accounts, and changing their role bindings. Deleting API tokens. Creating, rotating, and revoking application credentials, and turning OpenStack API access on or off. |
| Subscriptions and projects | Deleting subscriptions, and provisioning the first project of a new subscription. Creating, renaming, moving, and deleting projects. Allocating quota to projects, and granting or revoking the right to create projects. |
How long records are kept
Records of finished operations are deleted after a retention period that Bulutistan sets. Records of operations that haven't finished are kept.
If you need records for longer, for example for your own audits, export them regularly.
Ways to read the records
- Activity Log. In the console, open Activity log. Choose a time range, filter by action and result, and search by action, resource, or actor. Export page (CSV) saves the page of records that you see as a CSV file; the file doesn't include the source address. See Filter and export activity.
- Identity & Access. Identity & AccessActivity lists the same records. For the exact result of an operation, check it in the Activity log.
- REST API. GET
/scopes/{scopeId}/activity/activity-eventsreturns the records for a time range, eitherrange(1h,24h,7d, or30d) orfromandto, with the filtersaction,actor,result, andq. It returns at most 200 records per page, with totals per result for the whole range. See Pagination.
curl "https://<api-host>/api/v1/scopes/<project-id>/activity/activity-events?range=24h&result=Failure" \
-H "Authorization: Bearer $PC_TOKEN"<api-host>: the API's host name.<project-id>: the project's ID. See Scopes, URLs, and request format.