Audit Logs

Audit Logs

Audit Logs allows Auditors to monitor user operations in their deployment.

Tracked Events

We track the following resources:

Resource
Group
create, write, delete
FieldTracked
GitSSHKey
create
FieldTracked
created_atfalse
private_keytrue
public_keytrue
updated_atfalse
user_idtrue
Template
write, delete
FieldTracked
active_version_idtrue
allow_user_cancel_workspace_jobstrue
created_atfalse
created_bytrue
default_ttltrue
deletedfalse
descriptiontrue
display_nametrue
group_acltrue
icontrue
idtrue
is_privatetrue
min_autostart_intervaltrue
nametrue
organization_idfalse
provisionertrue
updated_atfalse
user_acltrue
TemplateVersion
create, write
FieldTracked
created_atfalse
created_bytrue
idtrue
job_idfalse
nametrue
organization_idfalse
readmetrue
template_idtrue
updated_atfalse
User
create, write, delete
FieldTracked
avatar_urlfalse
created_atfalse
deletedtrue
emailtrue
hashed_passwordtrue
idtrue
last_seen_atfalse
login_typefalse
rbac_rolestrue
statustrue
updated_atfalse
usernametrue
Workspace
create, write, delete
FieldTracked
autostart_scheduletrue
created_atfalse
deletedfalse
idtrue
last_used_atfalse
nametrue
organization_idfalse
owner_idtrue
template_idtrue
ttltrue
updated_atfalse
WorkspaceBuild
start, stop
FieldTracked
build_numberfalse
created_atfalse
daily_costfalse
deadlinefalse
idfalse
initiator_idfalse
job_idfalse
provisioner_statefalse
reasonfalse
template_version_idtrue
transitionfalse
updated_atfalse
workspace_idfalse

Filtering logs

In the Coder UI you can filter your audit logs using the pre-defined filter or by using the Coder's filter query like the examples below:

  • resource_type:workspace action:delete to find deleted workspaces
  • resource_type:template action:create to find created templates

The supported filters are:

  • resource_type - The type of the resource. It can be a workspace, template, user, etc. You can find here all the resource types that are supported.
  • resource_id - The ID of the resource.
  • resource_target - The name of the resource. Can be used instead of resource_id.
  • action- The action applied to a resource. You can find here all the actions that are supported.
  • username - The username of the user who triggered the action.
  • email - The email of the user who triggered the action.
  • date_from - The inclusive start date with format YYYY-MM-DD.
  • date_to - The inclusive end date with format YYYY-MM-DD.
  • build_reason - To be used with resource_type:workspace_build, the initiator behind the build start or stop.

Enabling this feature

This feature is only available with an enterprise license. Learn more

Was this page helpful? Share your experience with us.

 

See an opportunity to improve our docs? Make an edit.

A tool that provisions remote development environments via Terraform
On this page