> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shiftlabs.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Track and monitor all Vault operations

Audit Logs provide a comprehensive record of all operations performed on Vault resources. Every read, write, delete, and administrative action is logged for security monitoring, compliance, and troubleshooting.

## Key Features

<CardGroup cols={2}>
  <Card title="Complete Tracking" icon="eye">
    Every Vault operation is logged including reads, writes, deletes, and policy changes.
  </Card>

  <Card title="User Attribution" icon="user">
    Each log entry includes who performed the action with username and email.
  </Card>

  <Card title="Filtering & Search" icon="filter">
    Filter logs by action type, resource, status, and search by path.
  </Card>

  <Card title="CSV Export" icon="download">
    Export logs for external analysis, compliance reports, or archival.
  </Card>
</CardGroup>

## Required Permissions

Viewing audit logs requires `iam:project:cicd:vault:read` permission. Audit logs cannot be modified or deleted by any user.

## How to Filter Logs

<Steps>
  <Step title="Search by Path">
    Enter a path pattern in the search box to find operations on specific secrets or folders.
  </Step>

  <Step title="Filter by Action">
    Select an action type from the dropdown:

    * All Actions
    * Read, Write, Delete, List, Create
    * Rollback, Destroy, Revoke
  </Step>

  <Step title="Filter by Resource">
    Select a resource type:

    * All Resources
    * Secrets, Policies, Tokens, Mounts
  </Step>

  <Step title="Filter by Status">
    Filter by operation result:

    * All Status
    * Success
    * Failed
  </Step>
</Steps>

<Tip>
  Combine multiple filters to narrow down results. For example: Action = "Delete" + Status = "Failed" to find all failed deletion attempts.
</Tip>

## How to Export Logs

<Steps>
  <Step title="Apply Filters (Optional)">
    Set up any filters to limit the export scope.
  </Step>

  <Step title="Click Export">
    Click the download button in the toolbar.
  </Step>

  <Step title="Download CSV">
    A CSV file downloads automatically with all matching log entries.
  </Step>
</Steps>

The exported CSV includes all fields and is suitable for:

* Compliance reporting
* External SIEM integration
* Long-term archival
* Spreadsheet analysis

## Common Use Cases

### Security Investigation

Find unauthorized access attempts:

1. Filter by Status = **Failed**
2. Search for sensitive paths
3. Review user and timestamp patterns

### Compliance Audit

Generate access reports:

1. Filter by Resource = **Secret**
2. Export to CSV
3. Review who accessed what and when

### Troubleshooting

Debug permission issues:

1. Search for the affected path
2. Find the user's recent operations
3. Check for Failed status and error messages

### Change Tracking

Monitor configuration changes:

1. Filter by Action = **Write** or **Delete**
2. Filter by Resource = **Policy**
3. Review who changed policies and when

## Understanding Failed Operations

Common failure reasons:

| Error                 | Meaning                          |
| --------------------- | -------------------------------- |
| **Permission denied** | Token lacks required policy      |
| **Path not found**    | Secret or resource doesn't exist |
| **Invalid token**     | Token expired or revoked         |
| **Rate limited**      | Too many requests                |
| **Seal status**       | Vault is sealed                  |

## Troubleshooting

<AccordionGroup>
  <Accordion title="Logs not appearing" icon="circle-question">
    * Refresh the page or click the refresh button
    * Check that you have read permission for Vault audit logs
    * Logs may take a moment to propagate after operations
  </Accordion>

  <Accordion title="Cannot find specific operation" icon="circle-question">
    * Clear all filters and search by path
    * Check the time range - logs may be older than displayed period
    * Verify the operation actually occurred (check other logs)
  </Accordion>

  <Accordion title="Export fails" icon="circle-question">
    * Check your permissions
    * Large exports may timeout - try filtering to reduce data
    * Retry after a few moments
  </Accordion>

  <Accordion title="User shows as 'Unknown'" icon="circle-question">
    * The user account may have been deleted
    * Operation may have been performed by a service token
    * Root token operations may not have user attribution
  </Accordion>

  <Accordion title="Missing logs for known operations" icon="circle-question">
    * Audit logging may not be enabled for all mounts
    * Some internal operations are not logged
    * Check with administrator for audit configuration
  </Accordion>
</AccordionGroup>

## FAQ

<AccordionGroup>
  <Accordion title="How long are logs retained?">
    Log retention depends on your Vault and database configuration. Contact your administrator for specific retention policies.
  </Accordion>

  <Accordion title="Can I see the actual secret values in logs?">
    No. For security reasons, secret values are never logged. Only metadata (path, action, user, time) is recorded.
  </Accordion>

  <Accordion title="Are read operations logged?">
    Yes. Every operation including reads is logged. This is important for security auditing to know who accessed sensitive data.
  </Accordion>

  <Accordion title="Can I delete audit logs?">
    No. Audit logs cannot be modified or deleted to maintain integrity for compliance and security purposes.
  </Accordion>

  <Accordion title="What's the difference between Delete and Destroy?">
    Delete soft-deletes a secret version (recoverable). Destroy permanently removes it (irrecoverable). Both are logged separately.
  </Accordion>

  <Accordion title="How can I get alerts for specific events?">
    Export logs to an external SIEM system and configure alerts there. The platform does not currently support native alerting on audit events.
  </Accordion>
</AccordionGroup>

## Best Practices

### Regular Review

* Schedule weekly reviews of failed operations
* Monitor for unusual patterns (off-hours access, bulk operations)
* Track policy changes and token creations

### Export & Archive

* Export logs periodically for compliance
* Store exports in immutable storage
* Maintain exports beyond the platform's retention period if required

### Access Control

* Limit who can view audit logs (sensitive information)
* Use separate policies for audit log access
* Monitor access to the audit logs themselves