Administration
Audit log
See who changed what in the control plane and when, what the audit log records and what it leaves out.
The audit log records every action that changes something in the control plane: who did it, which request they made, when, and whether it succeeded. Use it to answer "who paused that pipeline" or "who changed this connection".
Only a SuperAdmin can read it. The log covers the whole control plane, across every account, so it isn't something an account's own administrators see.
Open the audit log
- Sign in as a SuperAdmin.
- Open the account menu, select Settings, and then select Audit log.
Audit log, subtitled Every mutating operator action, most recent first, lists entries 200 at a time and pages back to the oldest, so you can review the whole log for a compliance check. Type in Filter… to keep the entries whose actor, method, path or status code contains the text.
Read an entry
| Column | Meaning |
|---|---|
| Time | How long ago. Hover to see the exact time. |
| Actor | The email address of the person who made the change. |
| Request | The action, as the request the web app or the CLI sent. For example POST /pipelines/orders-sql-to-pg/dispatch/pause. |
| Status | The HTTP status code the control plane answered. Green is a success, 2xx. Amber is a refusal, 4xx. Red is a server error, 5xx. |
The entry for a pipeline names the pipeline by its ID, which appears in the path.
Some common requests:
| Request | What it was |
|---|---|
POST /pipelines | A pipeline was created. |
POST /pipelines/<id>/dispatch/start, …/pause, …/reload | A pipeline was started, paused or reloaded. |
POST /pipelines/<id>/assign | A pipeline was assigned to an agent, or unassigned. |
POST /pipelines/<id>/archive, DELETE /pipelines/<id> | A pipeline was archived, or permanently deleted. |
POST /agents/<id>/approve | An agent was approved. |
DELETE /agents/<id> | An agent was revoked or removed. |
POST /brokers/<id>/approve, …/revoke | A log broker was approved or revoked. |
POST /join-codes | A join code was created. |
POST /connection-repository | A saved connection was created or replaced. |
POST /alerts/<id>/acknowledge, …/resolve | An alert was acknowledged or resolved. |
POST /notification-channels | A notification channel was added. |
POST /accounts, POST /accounts/<id>/users | An account was created, or a person was added to one. |
An entry records the path but not the query string, so revoking an agent and removing an agent both appear as DELETE /agents/<id>. Diagnostics entries are the exception; see What is recorded.
What is recorded
SQL Flow records every change a signed-in person makes, through the web app or the CLI.
It records refused requests too. A pause attempt by a Viewer shows up with status 403, and a request that conflicts with the pipeline's state shows up as 409. A 5xx entry means the control plane failed to handle the request.
Diagnostics for support are recorded more closely:
- Each request for diagnostics, or to save raw log bytes on an agent, is recorded like any other change.
- Each download of a diagnostics bundle is recorded, although it is a read, as
GET /pipelines/<id>/diagnostics/<collection id>/download?kind=redacted, with the bundle's SHA-256 and size when it succeeds. Raw log bytes stay on the agent, so they have no download entry. - When a bundle expires or is removed, an entry with the actor
system:diagnostics-retentionrecords it.
What is not recorded
- Reads, except diagnostics downloads. Looking at a page or listing resources leaves no entry.
- Sign-ins, sign-outs, password changes and password resets. Failed sign-in attempts aren't recorded either.
- Traffic from agents and log brokers to the control plane.
- Requests without a signed-in person.
- The contents of a request. The log has no request bodies, passwords, secrets or tokens.
- The account the person was working in.
Keep in mind
- Entries are never deleted. The control plane removes log events, schema events and resolved alerts after 14 days, but keeps audit entries as a long-term record.
- Recording is best-effort. If the control plane can't write an entry, the action still completes. A gap in the log doesn't prove nothing happened.
