Documentation for automated readers A curated documentation index is available at: https://grafana.com/llms.txt
A complete documentation index is available at: https://grafana.com/llms-full.txt These indexes can help with page discovery before fetching individual documents.
This page is also available in Markdown, which may be easier for automated readers
and AI tools to parse than HTML. The Markdown version is available at
https://grafana.com/docs/grafana/next/setup-grafana/configure-security/audit-grafana.md, or by sending
Accept: text/markdown to https://grafana.com/docs/grafana/next/setup-grafana/configure-security/audit-grafana/. For broader
documentation discovery, the curated index is available at https://grafana.com/llms.txt
and the complete index is available at https://grafana.com/llms-full.txt.
Menu
This is documentation for the next version of Grafana documentation. For the latest stable release, go to the latest version.
Auditing allows you to track important changes to your Grafana instance. Depending on your deployment, you can send audit logs to a file, a Loki-compatible endpoint, or the Grafana default logger.
Only API requests or UI actions that trigger an API request generate an audit log.
Grafana Enterprise supports all three exporters: file, Loki, and console.
Grafana Cloud uses the Loki exporter. To enable audit logs for your Grafana Cloud instance, file a support ticket. Standard ingest and retention rates apply.
Understand audit logs
Audit logs are JSON objects representing user actions like:
Modifications to resources such as dashboards and data sources.
A user failing to log in.
Review the audit log format
Audit logs contain the following fields. The fields followed by * are always available, the others depend on the type of action logged.
Field name
Type
Description
timestamp*
string
The date and time the request was made, in coordinated universal time (UTC) using the RFC3339 format.
user*
object
Information about the user that made the request. Either one of the UserID or ApiKeyID fields contains content if isAnonymous=false.
user.userId
number
ID of the Grafana user that made the request.
user.orgId*
number
Current organization of the user that made the request.
user.orgRole
string
Current role of the user that made the request.
user.name
string
Name of the Grafana user that made the request.
user.authTokenId
number
ID of the user authentication token.
user.apiKeyId
number
ID of the Grafana API key used to make the request.
user.isAnonymous*
boolean
If an anonymous user made the request, true. Otherwise, false.
action*
string
The request action. For example, create, update, or manage-permissions.
request*
object
Information about the HTTP request.
request.params
object
Request’s path parameters.
request.query
object
Request’s query parameters.
request.body
string
Request’s body. Filled with <non-marshalable format> when it isn’t a valid JSON.
result*
object
Information about the HTTP response.
result.statusType
string
If the request action was successful, success. Otherwise, failure.
result.statusCode
number
HTTP status of the request.
result.failureMessage
string
HTTP error message.
result.body
string
Response body. Filled with <non-marshalable format> when it isn’t a valid JSON.
resources
array
Information about the resources that the request action affected. This field can be null for non-resource actions such as login or logout.
resources[x].id
number
ID of the resource, when available.
resources[x].type*
string
The type of the resource that was logged: alert, alert-notification, annotation, api-key, auth-token, dashboard, datasource, folder, org, panel, playlist, report, team, user, or version.
resources[x].uid
string
UID of the resource, when available.
resources[x].name
string
Name of the resource, when available. Grafana currently populates this field for user resources.
requestUri*
string
Request URI.
ipAddress*
string
IP address that the request was made from.
userAgent*
string
Agent through which the request was made.
grafanaVersion*
string
Current version of Grafana when this log is created.
additionalData
object
Additional information that can be provided about the request.
The additionalData field can contain the following information:
Field name
Action
Description
loginUsername
login
Login used in the Grafana authentication form.
extUserInfo
login
User information provided by the external system that was used to log in.
authTokenCount
login
Number of active authentication tokens for the user that logged in.
terminationReason
logout
The reason why the user logged out, such as a manual logout or a token expiring.
billing_role
billing-information
The billing role associated with the billing information being sent.
Identify recorded actions
The audit logs include records about the following categories of actions. Each action is
distinguished by the action and resources[...].type fields in the JSON record.
For example, creating an API key produces an audit log like this:
Some actions can only be distinguished by their requestUri fields. For those actions, the relevant
pattern of the requestUri field is given.
Almost all recorded actions correspond to API requests or UI actions that trigger an API request. For example, the action {"action": "email", "resources": [{"type": "report"}]} corresponds to a user-initiated email preview of a report, not a scheduled send.
* Where AUTH-MODULE is the name of the authentication module: grafana, saml,
ldap, etc. ** Includes manual log out, token expired/revoked, and
SAML Single Logout.
