View Organization Audit Logs in the Cloud Console

On this page

CockroachDB Cloud captures audit logs when many types of events occur, such as when a cluster is created or when a user is added to or removed from an organization.

View audit logs

To access the Audit Logs page:

1. Navigate to the CockroachDB Cloud Console and log in as a user with the Organization Admin role.
2. In the top navigation bar, open the Organization menu and select Audit Logs.

Filter audit logs

Filter the audit logs by the following fields:

• Time Range (UTC):
  • Default: Last 48 hours.
  • To set the time range, click the Time Range (UTC) field. You can select a Start date and End date from the displayed calendar or manually enter dates and times for the range.
• User email: Select one or more email addresses from the list of organization members (optional).
• Action name: Select one or more predefined auditable actions (optional).
• Cluster name: Select one or more cluster names (optional).

Audit Logs table

If audit logs are found for the filter selections, a table is displayed with the following columns:

• Time (UTC)

• User: Displays the following:

  • User's email if Source is UI.
  • Service account name if Source is API. (Note: You cannot filter by service account name.)
  • CRL User if Source is CRL. (Note: You cannot filter by CRL User.)

• Action name

• Cluster name

• Source: Displays the following:

  • UI for actions executed in the Cloud Console.
  • API for actions executed via the Cloud API.
  • CRL for actions executed by Cockroach Labs.

Audit log details

Click a row in the Audit Logs table to open the Action details panel, which displays event information, including the full payload in the Details section.

URL query parameters

All selected filters are reflected in the URL query parameters, making it easy to share specific views. For example:

• startingFrom and endingAt: Define the selected time range.
• logId: Specifies the Action ID of an expanded log entry in the sidebar.

https://cockroachlabs.cloud/audit-logs?startingFrom=2025-03-04T19%3A51%3A36.590Z&endingAt=2025-03-07T19%3A51%3A36.000-05%3A00&logId=78d55b3c-424e-45fa-bbce-03f2ed738897

Example use cases

For organization administrators, security teams, and compliance officers, audit logs provide critical insights into system activities. These logs are essential for:

• Tracking user role changes
  • Example: To identify when and by whom an Admin role was assigned, filter by the action ADD_USER_TO_ROLE.
• Investigating cluster costs
  • Example: To determine who created a cluster and when, filter by the action CREATE_CLUSTER.
• Understanding IP allowlisting changes
  • Example: To identify why and by whom an IP address was added, filter by the action ADD_IP_ALLOWLIST.
• Verifying cluster deletions
  • Example: To ensure cluster deletions were intentional, filter by the action DELETE_CLUSTER.
• Diagnosing performance issues
  • Example: To track configuration changes affecting performance, filter by the action UPDATE_CLUSTER.
• Analyzing security threats
  • Example: To investigate failed login attempts and suspicious login activity, filter by the action USER_LOGIN.
• Reviewing maintenance schedule changes
  • Example: To track modifications to maintenance windows, filter by the actions SET_CLUSTER_MAINTENANCE_WINDOW and DELETE_CLUSTER_MAINTENANCE_WINDOW.

See also

• Export CockroachDB Cloud Organization Audit Logs

Was this helpful?