Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions docs/admin/audit_log.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -51,9 +51,9 @@ Here's a word-by-word breakout to demonstrate how the captured entry aligns with

### What is audited?

- [Security events](./security_event_logs)
- [Gitserver access](https://sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/cmd/gitserver/internal/accesslog/accesslog.go?L100-104)
- [GraphQL requests](https://sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/cmd/frontend/internal/httpapi/graphql.go?L226-244)
- **Security Events** - [A list of events](./security_event_logs) such as logins, site configuration updates, code host configuration updates (_These logs can be sent to the database for easier collection as well as to the standard output_).
- **Gitserver Access** - Requests to the [`gitserver`](./deploy/scale.mdx#gitserver) component that is responsible for brokering transactions between the git repos on disk and all other Sourcegraph components.
- **GraphQL Requests** - Requests To The Sourcegraph [`frontend`](./deploy/scale.mdx#frontend) component that is usually named `sourcegraph-frontend-{DYNAMICALLY CREATED ALPHANUMERIC}`

This list is expected to grow in the future.

Expand Down Expand Up @@ -89,6 +89,9 @@ Audit logs are structured logs. As long as one can ingest logs, we assume one ca

### On Premises

All logs mentioned are delivered to the standard output (stdout) for each individual [component](./deploy/scale.mdx#core-components).


There are two easy approaches to filtering the audit logs:

- JSON-based: look for the presence of the `Attributes.audit` node. Do not depend on the log level, as it can change based on `SRC_LOG_LEVEL`.
Expand Down
Loading