diff --git a/docs/admin/audit_log.mdx b/docs/admin/audit_log.mdx index 05c837dfb..6375c8279 100644 --- a/docs/admin/audit_log.mdx +++ b/docs/admin/audit_log.mdx @@ -51,9 +51,9 @@ Here's a word-by-word breakout to demonstrate how the captured entry aligns with ### What is audited? -- [Security events](./security_event_logs) -- [Gitserver access](https://sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/cmd/gitserver/internal/accesslog/accesslog.go?L100-104) -- [GraphQL requests](https://sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/cmd/frontend/internal/httpapi/graphql.go?L226-244) +- **Security Events** - [A list of events](./security_event_logs) such as logins, site configuration updates, code host configuration updates (_These logs can be sent to the database for easier collection as well as to the standard output_). +- **Gitserver Access** - Requests to the [`gitserver`](./deploy/scale.mdx#gitserver) component that is responsible for brokering transactions between the git repos on disk and all other Sourcegraph components. +- **GraphQL Requests** - Requests To The Sourcegraph [`frontend`](./deploy/scale.mdx#frontend) component that is usually named `sourcegraph-frontend-{DYNAMICALLY CREATED ALPHANUMERIC}` This list is expected to grow in the future. @@ -89,6 +89,9 @@ Audit logs are structured logs. As long as one can ingest logs, we assume one ca ### On Premises +All logs mentioned are delivered to the standard output (stdout) for each individual [component](./deploy/scale.mdx#core-components). + + There are two easy approaches to filtering the audit logs: - JSON-based: look for the presence of the `Attributes.audit` node. Do not depend on the log level, as it can change based on `SRC_LOG_LEVEL`.