Review rule changes with the audit log
Note
The Adaptive Metrics audit log is currently in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.
The audit log lists the rule changes made to a segment. Use it to answer questions such as “What changed in this segment last week?”, “Was this rule added by a recommendation or by hand?”, and “Which metrics did auto-apply touch?”.
Each entry in the log is an operation: one batch of rule changes that happened together. For example, applying five recommendations at once is one operation with five changes.
This topic explains how to find the audit log, narrow the list of operations, and open an operation to see the metrics it changed.
Before you begin
Before you begin ensure you have the following:
- Access to the Adaptive Metrics plugin in Grafana Cloud
- Permission to read rules, for example the Rules Reader or Rules Editor role
Refer to Manage access to Grafana Adaptive Metrics for the roles.
Open the audit log
To open the audit log:
- In Grafana Cloud, go to Adaptive Metrics > Configuration.
- Select the Audit log tab.
The Audit log tab only appears when the audit log is enabled for your stack.
Choose which operations to show
The audit log shows one segment at a time. Rules in other segments aren’t listed until you switch segments.
Use the controls above the table to narrow the list:
- Segment: Select the segment whose operations you want to review
- Lookback: Select how far back to look, from Past 24 hours, Past 7 days (the default), or Past 30 days
- Refresh operations: Load the latest operations
The refresh button shows a spinner while it loads. If a refresh fails, the table keeps the operations that are already loaded and shows a warning that they might be out of date.
If no operations are listed, try a longer Lookback or a different segment.
Read the operations table
The table has one row for each operation, with these columns:
The Source column shows one of the following values:
The table header stays visible under the controls as you scroll.
Note
The audit log shows what changed, not who made the change.
Open an operation
To see what an operation changed, select its row or its Details button. A drawer opens on the right.
The drawer shows:
- The time of the operation and the segment it belongs to
- A summary with the time, the source, how long ago it happened, the number of rules created, updated, and deleted, and a Copy operation link button
- The Affected metrics list
Close the drawer to return to the table.
Read the affected metrics
Each row in Affected metrics shows the metric name and a Change badge: Created, Updated, or Deleted. When the rule matches a prefix or suffix instead of one exact metric name, a Prefix or Suffix badge appears before the name.
To see how a rule’s labels changed, expand its row:
- Removed lists the labels that were aggregated away before the change and aren’t now
- Added lists the labels that are aggregated away after the change
Each side shows a count, and None when it has no labels. If a rule keeps labels instead of aggregating them away, the entry reads All labels except followed by the kept labels.
When an operation affects many metrics, the list loads as you scroll, and a count such as “Showing 50 of 250 affected metrics” shows how many are loaded. If a page of metrics fails to load, the metrics that are already loaded stay visible and an error explains what failed.
When an operation can’t be shown in full
The drawer shows one of the following messages when it can’t list everything:
- The details of this operation are no longer retained: The operation is older than the rule history that Adaptive Metrics keeps, so its affected metrics can’t be listed. The table still shows its time, source, and counts
- This operation was not found in this segment: The operation isn’t in the selected segment, or it doesn’t exist. Select the segment it belongs to
- There was a problem retrieving this operation: Close the drawer and try again. If the problem persists, contact Grafana Support
- The rule before this change is no longer retained, or after: Shown in an expanded row when one side of the change isn’t stored. The metric and the type of change are still listed, but the label changes aren’t
Share an operation
To share an operation with a colleague, select Copy operation link in the drawer and send them the link. The link opens the same operation in the same segment for anyone who can read rules.
Next steps
Was this page helpful?
Related resources from Grafana Labs
