Read the audit log

The audit log records who did what across your account’s resources, and when. A node’s power actions and a change to an IAM user both show there. Filter it to the actions you want, then download it as a CSV file or have it emailed to you.

Before you begin

Decide which service and period you want, such as Compute over the last month. The log comes to you as a file, so filtering first keeps it to what you need.

Open Audit Log

In MyAccount, open Settings, then Audit Log. The log is grouped by service, such as Compute, Storage, Database, and Network.

Filter the log

Narrow the log before you download or send it:

• Select Services: the service, such as Compute or Network.
• A resource or IAM user to filter on.
• Select Logs Type and Select Event: the kind of record and the action, from lists that change with the service you chose. Activity Logs list each action taken, one entry per action. Technical Logs show a resource’s usage over its lifetime, with dates and times; services such as Object Storage, CDN, Kubernetes, Functions, and IAM have activity logs only.
• Select Performer: who carried out the action.
• Select Period: Current Month, Previous Month, Last 6 Months, or Custom Period with a start and end date.

Download or send the log

Click Download Logs to save the filtered log as a CSV file at once.

Click Send Mail instead to have the filtered log emailed to you. The email also goes to the account’s admins and owner, or, for billing logs, to the billing contacts.

If the log shows a change you did not expect, check who has access to the account in Manage users.