Audit log
Use the audit log to access a record of operations, including who performed the operation, when it was performed, and on which entities the operation was performed.
Impact on secondary storage
When the audit log is active, a record is written to secondary storage for every applicable operation instance. By default, only user operations are tracked, not client operations. With this default behavior, you can expect a 3.5% increase in disk usage.
The audit log is enabled by default. Because of the increase in resource usage on secondary storage, you may see increased costs associated with this feature.
You can configure the audit log to fine tune log thoroughness and resource usage according to your needs.
Audit logs and Physical Tenants
Audit records are stored in the secondary-storage location configured for the Physical Tenant where the operation occurred. Query a tenant's records through its tenant-scoped API path, for example POST /physical-tenants/{physicalTenantId}/v2/audit-logs/search. The unprefixed POST /v2/audit-logs/search endpoint queries the default Physical Tenant. See search audit logs for request filters and response fields.
The API's tenantId field and filter refer to a Logical Tenant within the selected Physical Tenant. They do not select a Physical Tenant. Physical Tenant scope comes from the request path. For details about tenant-scoped API routing, see API routing for Physical Tenants.