Skip to content
Products
Platform
Developer Tools
Portal

Retrieve audit log events

Changes on organizations, folders and projects and respective cloud resources are logged and collected in the audit log.

Prerequisites

Section titled “Prerequisites”

To access the audit log with a user account, you must have the audit-log.entry.get permission. This permission is currently granted to users with the project owner, editor, reader or audit-log.reader role.

Service accounts require the audit-log.reader role to access audit logs. To assign this role to a user or service account, follow these steps:

  1. Navigate to IAM and management > Access.
  2. Click Grant access.
  3. Paste the email address into the Subject field and click +Add.
  4. In the role dropdown select By products or services > Audit log > Audit log reader.
  5. Click Save.

Organization events

Section titled “Organization events”

You can view organization events under the Audit log section in the main navigation. A list of all events from the last 90 days is displayed. It shows information about the event name, the initiator, and the time the action was carried out.

Folder events

Section titled “Folder events”

You can view folder events under the Audit log section in the main navigation. A list of all events from the last 90 days is displayed. It shows information about the event name, the initiator, and the time the action was carried out.

Project events

Section titled “Project events”

You find the project audit log under Information > Audit log in the side navigation menu.

The project audit log shows all log events for a specific project. It can’t be changed or accessed by another project. When a user takes an action in a project, the action is sent as an event to that project’s audit log.

Each event in the log has the following details:

  • Event Name: The action that triggered the event.
  • Event ID: A unique identifier for tracing the event.
  • Time Stamp: The creation time of the event.
  • Initiator: The global user ID of the user who performed the action. In the portal, this ID is converted to an email address.
  • Initiator IP: The IP address of the user who performed the action.
  • Project ID: The ID of the project the event belongs to.
  • Additional Event Data: Extra event data displayed in JSON format. This can include, for example, the metadata of a newly created security rule.