Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Audit Logging

Retrieving auditing information for core PCD services

Overview

Audit logs in Private Cloud Director provide users with the ability to view the actions that have taken place on their environment. Currently audit logging is enabled for the following services:

  • Identity

  • Compute

  • Networking

Audit Log Retrieval for Admin Users

Admin users can now retrieve audit logs directly from the UI. To access the logs, navigate to Settings (gear icon) and select Audit Logs within the Private Cloud Director UI.

Mandatory Filters

When accessing audit logs, the following filters must be specified:

  • Region

  • Domain

  • Tenant

  • Service

By default, the logs from the past 24 hours are retrieved with additional filters, such as a custom time range, available by enabling the Use Optional Filters toggle.

Downloading Audit Logs

Clicking the Download Logs button will download the logs as a .ndjson file, containing one JSON object per line. An example format is shown below:

Fields that cannot be populated will display as unknown, and UUID fields will be represented as 00000000-0000-0000-0000-000000000000. The roles_list and metadata fields are omitted from the output when empty.

Service Account Log Filtering

By default, log entries generated by internal PCD service accounts (such as nova, neutron, and cinder) are excluded from the retrieval API to reduce noise from inter-service traffic. To include these entries in the response, pass the includeServiceAccounts=true query parameter on the export endpoint.

Audit Capabilities

Currently, auditing is enabled for compute, networking, storage, image, and identity services, with more detailed capabilities planned for future releases.

As of the 2026.4 release, for the compute, storage, and identity service, we have enhanced the information that audit logs capture. The following additional details are captured for these services:

  • Resource IDs for resource creation actions

  • Relevant request metadata for actions such as migrations and role assignments to capture secondary resources that the action refers to

  • Resource names are now captured for improved log readability

  • Roles at the time of the action are now captured in the audit logs

Note the following known issue:

  • For the image and networking service Resource IDs are not populated during the creation of a resource. Subsequent actions will display the resource ID correctly.

Deployment Options for Audit Logs Note: The following information is targetted for PCD self-hosted customers. SaaS customers should communicate retention requirements with the support team to configure audit logging on their environment.

More information on configuring options for Self Hosted PCD can be found here:

Storage Class Customisation

Several parameters can be set through deployment options to configure audit logging:

  • audit_pvc_size: Size of the PVC associated with the audit database (default: 5Gi)

  • audit_pvc_sc: Storage class associated with the audit PVC (default: "" (default storage class))

  • audit_retention_days: Number of days logs are retained (default: 7)

Example configuration:

Audit Log Retrieval API:

Audit logs can also be accessed via API. This is an admin only endpoint.

Export Audit Logs

get

Streams audit logs matching the provided filters. The response is in NDJSON (Newline Delimited JSON) format to support large datasets without memory buffering.

If no start_time is provided, defaults to the last 24 hours.

Authorizations
x-auth-tokenstringRequired

Platform9 authentication token obtained from the identity service.

Query parameters
regionstringOptional

Filter by region name.

project_idstring · uuidOptional

Filter by tenant UUID.

user_idstring · uuidOptional

Filter by User ID.

usernamestringOptional

Filter by username.

actionstringOptional

Filter by action name (e.g., 'authenticate', 'create').

resource_typestringOptional

Filter by resource type (e.g., 'service/compute/server').

servicestringOptional

Filter by component/service name.

start_timestring · date-timeOptional

Start of the time range (RFC3339). Defaults to T-24h.

end_timestring · date-timeOptional

End of the time range.

limitintegerOptional

Maximum number of records to return.

Responses
200

A stream of audit logs.

application/x-ndjson
stringOptional

Stream of JSON objects (AuditLog) separated by newlines.

Example: {"timestamp_utc":"2023-10-01T12:00:00Z","region":"us-east","action_name":"create","username":"admin"} {"timestamp_utc":"2023-10-01T12:01:00Z","region":"us-east","action_name":"delete","username":"admin"}
get/resmgr/audit/export
GET /resmgr/audit/export HTTP/1.1
Host: your.du.url
x-auth-token: YOUR_API_KEY
Accept: */*

{"timestamp_utc":"2023-10-01T12:00:00Z","region":"us-east","action_name":"create","username":"admin"}
{"timestamp_utc":"2023-10-01T12:01:00Z","region":"us-east","action_name":"delete","username":"admin"}

Get Filter Options

get

Retrieves unique values for regions, projects, domains, and actions to populate UI filter dropdowns.

Authorizations
x-auth-tokenstringRequired

Platform9 authentication token obtained from the identity service.

Responses
200

Available filter options.

application/json
outcomesstring[]Optional
regionsstring[]Optional
project_idsstring · uuid[]Optional
domainsstring[]Optional
action_namesstring[]Optional
action_resultsstring[]Optional
get/resmgr/audit/filters
GET /resmgr/audit/filters HTTP/1.1
Host: your.du.url
x-auth-token: YOUR_API_KEY
Accept: */*

{
  "services": {
    "compute": [
      "instance",
      "flavor"
    ],
    "networking": [
      "network",
      "port"
    ]
  },
  "outcomes": [
    "text"
  ],
  "regions": [
    "text"
  ],
  "project_ids": [
    "123e4567-e89b-12d3-a456-426614174000"
  ],
  "domains": [
    "text"
  ],
  "action_names": [
    "text"
  ],
  "action_results": [
    "text"
  ]
}
PreviousService Health Dashboard
NextAlerting Setup Guide

Last updated

Was this helpful?