Audit logs

Root users can view application event audit logs from the Admin panel Audit logs tab.

Application event audit logs are retained for 365 days by default. In Platform Enterprise, this retention period can be customized.

Audit log event format

Audit log entries record the following event details:

• Type: A brief event description, such as user_sign_in, credentials_created, etc.
• Target: ID of the resource associated with the event, such as ID of created credentials, etc.
• Principal: ID of the user that performed the action. User IDs for user-initiated events, system for Seqera-initiated events.
• Status: Additional event information, such as workflow completion status, user sign-in method, etc.
• Organization ID
• Organization name
• Workspace ID
• Workspace name
• Client IP: IP address of user/client initiating the event. Empty for Seqera-initiated events.
• Creation date: Event timestamp in YYYY-MM-DD-HH-MM-SS format.

Audit log events

Audit logs include administration, security, and application resource events.

Resource	Events logged	Note
Access tokens	Add, delete	Log entry includes the access token ID.
Compute environments	Add, edit, delete	Edit event entries do not include the edited parameters.
Credentials	Add, edit, delete, access	Log entry includes the credential ID. A log entry is also created each time the credentials are accessed by the application.
Data Explorer cloud buckets	Add, edit, delete, hide, show	Events for public and private buckets are logged.
Data Explorer files	Download, upload, preview	Events for public and private bucket files are logged.
Organizations	Add, delete	Log entry includes the organization ID.
Participants	Add, update role, delete	Log entry includes the participant ID.
Pipelines	Add, delete	Log entry includes the pipeline ID.
Pipeline actions	Add, delete	Log entry includes the pipeline action ID.
Pipeline secrets	Add, edit, delete	Log entry includes the pipeline secret ID.
Runs	Launch, create, relaunch, resume, status change, complete, delete, drop	Relaunched/resumed runs are stored with the initial launch run ID. Deleted runs are marked for deletion before being dropped from the runs database by the application backend (constituting two events).
Teams	Add, delete	Log entry includes the team ID.
Users	Add, edit, delete	Log entry includes the user ID. See user deletion.
User sessions	Login	Login event entries include the login IP address.
Workspaces	Add, delete	Log entry includes the workspace ID.