Auditing

Auditing allows you to track important changes to your Grafana instance. By default, audit logs are logged to file but the auditing feature also supports sending logs directly to Loki.

Audit logs are JSON objects representing user actions like:

• Modifications ro resources such as dashboards and data sources.
• A user failing to log in.

Audit logs contain the following fields. The fields followed by * are always available, the others depend on the type of action logged.

The additionalData field can contain the following information:

The audit logs include records about the following categories of actions:

Sessions

• Log in.
• Log out (manual log out, token expired/revoked, ).
• Revoke a user authentication token.
• Create or delete an API key.

User management

• Enable or disable a user.
• Manage user role and permissions.
• LDAP sync or information access.

• Create, update, or delete a team or organization.
• Add or remove a member of a team or organization.
• Manage organization members roles.
• Manage team members permissions.
• Invite an external member to an organization.
• Revoke a pending invitation to an organization.
• Add or remove an external group to sync with a team.

Folder and dashboard management

• Create, update, or delete a folder.
• Manage folder permissions.
• Create, import, update, or delete a dashboard.
• Manage dashboard permissions.

Data sources management

• Create, update, or delete a data source.
• Manage data source permissions.

Alerts and notification channels management

• Create, update, or delete a notification channel.
• Test an alert or a notification channel.
• Pause an alert.

Reporting

• Create, update, or delete a report.
• Update reporting settings.
• Send reporting email.

Annotations, playlists and snapshots management

• Create, update, or delete an annotation.
• Create, update, or delete a playlist.
• Create or delete a snapshot.

Configuration

Audit logs can be saved into files, sent to a Loki instance or sent to the Grafana default logger. By default, only the file exporter is enabled. You can choose which exporter to use in the .

By default, when a user creates or updates a dashboard, its content will not appear in the logs as it can significantly increase the size of your logs. If this is important information for you and you can handle the amount of data generated, then you can enable this option in the configuration.

Each exporter has its own configuration fields.

Audit logs are saved into files. You can configure the folder to use to save these files. Logs are rotated when the file size is exceeded and at the start of a new day.

Audit logs are sent to a Loki service, through HTTP or gRPC.

If you have multiple Grafana instances sending logs to the same Loki service or if you are using Loki for non-audit logs, audit logs come with additional labels to help identifying them:

• host - OS hostname on which the Grafana instance is running.
• kind - auditing

Audit logs are sent to the Grafana default logger. The audit logs use the auditing.console logger and are logged on -level, learn how to enable debug logging in the log configuration section of the documentation. Accessing the audit logs in this way is not recommended for production use.