Auditing allows you to track important changes to your Grafana instance. By default, audit logs are logged to file but the auditing feature also supports sending logs directly to Loki.
Note
To enable sending Grafana Cloud audit logs to your Grafana Cloud Logs instance, please file a support ticket. Note that standard ingest and retention rates apply for ingesting these audit logs.
Only API requests or UI actions that trigger an API request generate an audit log.
Audit logs are JSON objects representing user actions like:
Modifications to resources such as dashboards and data sources.
A user failing to log in.
Format
Audit logs contain the following fields. The fields followed by * are always available, the others depend on the type of action logged.
Field name
Type
Description
timestamp*
string
The date and time the request was made, in coordinated universal time (UTC) using the RFC3339 format.
user*
object
Information about the user that made the request. Either one of the UserID or ApiKeyID fields will contain content if isAnonymous=false.
user.userId
number
ID of the Grafana user that made the request.
user.orgId*
number
Current organization of the user that made the request.
user.orgRole
string
Current role of the user that made the request.
user.name
string
Name of the Grafana user that made the request.
user.authTokenId
number
ID of the user authentication token.
user.apiKeyId
number
ID of the Grafana API key used to make the request.
user.isAnonymous*
boolean
If an anonymous user made the request, true. Otherwise, false.
action*
string
The request action. For example, create, update, or manage-permissions.
request*
object
Information about the HTTP request.
request.params
object
Request’s path parameters.
request.query
object
Request’s query parameters.
request.body
string
Request’s body. Filled with <non-marshalable format> when it isn’t a valid JSON.
result*
object
Information about the HTTP response.
result.statusType
string
If the request action was successful, success. Otherwise, failure.
result.statusCode
number
HTTP status of the request.
result.failureMessage
string
HTTP error message.
result.body
string
Response body. Filled with <non-marshalable format> when it isn’t a valid JSON.
resources
array
Information about the resources that the request action affected. This field can be null for non-resource actions such as login or logout.
resources[x].id*
number
ID of the resource.
resources[x].type*
string
The type of the resource that was logged: alert, alert-notification, annotation, api-key, auth-token, dashboard, datasource, folder, org, panel, playlist, report, team, user, or version.
requestUri*
string
Request URI.
ipAddress*
string
IP address that the request was made from.
userAgent*
string
Agent through which the request was made.
grafanaVersion*
string
Current version of Grafana when this log is created.
additionalData
object
Additional information that can be provided about the request.
The additionalData field can contain the following information:
Field name
Action
Description
loginUsername
login
Login used in the Grafana authentication form.
extUserInfo
login
User information provided by the external system that was used to log in.
authTokenCount
login
Number of active authentication tokens for the user that logged in.
terminationReason
logout
The reason why the user logged out, such as a manual logout or a token expiring.
billing_role
billing-information
The billing role associated with the billing information being sent.
Recorded actions
The audit logs include records about the following categories of actions. Each action is
distinguished by the action and resources[...].type fields in the JSON record.
For example, creating an API key produces an audit log like this:
json
{"action":"create","resources":[{"id":1,"type":"api-key"}],"timestamp":"2021-11-12T22:12:36.144795692Z","user":{"userId":1,"orgId":1,"orgRole":"Admin","username":"admin","isAnonymous":false,"authTokenId":1},"request":{"body":"{\"name\":\"example\",\"role\":\"Viewer\",\"secondsToLive\":null}"},"result":{"statusType":"success","statusCode":200,"responseBody":"{\"id\":1,\"name\":\"example\"}"},"resources":[{"id":1,"type":"api-key"}],"requestUri":"/api/auth/keys","ipAddress":"127.0.0.1:54652","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0","grafanaVersion":"8.3.0-pre"}
Some actions can only be distinguished by their requestUri fields. For those actions, the relevant
pattern of the requestUri field is given.
Note that almost all these recorded actions are actions that correspond to API requests or UI actions that
trigger an API request. Therefore, the action {"action": "email", "resources": [{"type": "report"}]} corresponds
to the action when the user requests a report’s preview to be sent through email, and not the scheduled ones.
* Where AUTH-MODULE is the name of the authentication module: grafana, saml,
ldap, etc. ** Includes manual log out, token expired/revoked, and SAML Single Logout.
Cloud Migration Assistant is currently in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.
To use this feature, enable the onPremToCloudMigrations feature toggle in your Grafana configuration file or at Administration > General > Feature toggles in Grafana Cloud.
In addition to the actions listed above, any HTTP request (POST, PATCH, PUT, and DELETE)
against the API is recorded with one of the following generic actions.
Furthermore, you can also record GET requests. See below how to configure it.
Action
Distinguishing fields
POST request
{"action": "post-action"}
PATCH request
{"action": "partial-update"}
PUT request
{"action": "update"}
DELETE request
{"action": "delete"}
GET request
{"action": "retrieve"}
Configuration
Note
The auditing feature is disabled by default.
Audit logs can be saved into files, sent to a Loki instance or sent to the Grafana default logger. By default, only the file exporter is enabled.
You can choose which exporter to use in the configuration file.
Options are file, loki, and logger. Use spaces to separate multiple modes, such as file loki.
By default, when a user creates or updates a dashboard, its content will not appear in the logs as it can significantly increase the size of your logs. If this is important information for you and you can handle the amount of data generated, then you can enable this option in the configuration.
ini
[auditing]
# Enable the auditing feature
enabled = false
# List of enabled loggers
loggers = file
# Keep dashboard content in the logs (request or response fields); this can significantly increase the size of your logs.
log_dashboard_content = false
# Keep requests and responses body; this can significantly increase the size of your logs.
verbose = false
# Write an audit log for every status code.
# By default it only logs the following ones: 2XX, 3XX, 401, 403 and 500.
log_all_status_codes = false
# Maximum response body (in bytes) to be audited; 500KiB by default.
# May help reducing the memory footprint caused by auditing.
max_response_size_bytes = 512000
Each exporter has its own configuration fields.
File exporter
Audit logs are saved into files. You can configure the folder to use to save these files. Logs are rotated when the file size is exceeded and at the start of a new day.
ini
[auditing.logs.file]
# Path to logs folder
path = data/log
# Maximum log files to keep
max_files = 5
# Max size in megabytes per log file
max_file_size_mb = 256
Loki exporter
Audit logs are sent to a Loki service, through HTTP or gRPC.
Note
The HTTP option for the Loki exporter is available only in Grafana Enterprise version 7.4 and later.
ini
[auditing.logs.loki]
# Set the communication protocol to use with Loki (can be grpc or http)
type = grpc
# Set the address for writing logs to Loki
url = localhost:9095
# Defaults to true. If true, it establishes a secure connection to Loki
tls = true
# Set the tenant ID for Loki communication, which is disabled by default.
# The tenant ID is required to interact with Loki running in multi-tenant mode.
tenant_id =
If you have multiple Grafana instances sending logs to the same Loki service or if you are using Loki for non-audit logs, audit logs come with additional labels to help identifying them:
host - OS hostname on which the Grafana instance is running.
grafana_instance - Application URL.
kind - auditing
When basic authentication is needed to ingest logs in your Loki instance, you can specify credentials in the URL field. For example:
ini
# Set the communication protocol to use with Loki (can be grpc or http)
type = http
# Set the address for writing logs to Loki
url = user:password@localhost:3000
Console exporter
Audit logs are sent to the Grafana default logger. The audit logs use the auditing.console logger and are logged on debug-level, learn how to enable debug logging in the log configuration section of the documentation. Accessing the audit logs in this way is not recommended for production use.