--- title: "Viewing Audit Logs" canonical: "https://docs.infoblox.com/space/BloxOneCloud/35430270/Viewing%20Audit%20Logs" format: markdown --- When you make changes to your Infoblox configuration through the Infoblox Portal or the API, the configuration changes are logged. Infoblox Portal displays audit logs, so you can view administrative activities performed by specific user accounts. > šŸ“ The retention period for audit logs is 13 months. The following are some of the logged information: - The username of the person updating or modifying the configuration - The IP address from which the configuration changes originated - The object name or configuration option being changed, such as named lists, bypass lists, DNS forwarding proxy, or internal domains - Enabling and disabling of apps on a NIOS-X server To view the audit logs, do the following: 1. From Infoblox Portal, click **System** > **Logs **>** Audit Logs**. 2. On the **Audit Logs** page, click **Display Recent** to display the most recent 100 system events. or Click to activate the filtering feature, and then click to configure your filter. From the **Basic Columns **menu, choose the filtering criterion you want to add. For example, if you choose **Timestamp**, select an applicable timeline within which you want to filter the results, using the calendar provided. **NOTE: Infoblox recommends that you apply a time range of no more than 30 days for best performance and response.** To add more filtering criteria, click again to add another criterion.Ā When you are done, click to filter the events. You can also click to remove the filter you just created. If you want to use the same criteria for future filtering, you can save the filter by clicking and entering a name for the filter. You can then click to find the saved filter in the future without setting the filtering criteria again. TheĀ **Audit Logs**Ā page provides a card view and a table view for displaying information. You can toggle between the card and table view by clicking the icon on the upper right corner of the navigation bar. - Card view - Table view By default, the card view displays the following information for each configuration you have created: - **Timestamp**: The timestamp is based on the preferred time zone set on the User Profile page. When you select a time on the **Servers > Logs** page, the filters are applied according to the time zone set on the User Profile page. - **User**: The name of the user account that performed the task. - **Source IP**: The IP address of the source destination that initiated the task. - **Resource Type**: The resource with which the performed task was associated. For example, if a user performed a specific task to a NIOS-X server, this field displays the name of the server. - **Action**: The specific action that was performed by the user. For example, if a user updated a the configuration of the NIOS-X server, this field displays **Update**; and if a user deleted tags on a NIOS-X server, this fields displays** Delete**. - **Event Summary**: Displays information about the action that has been taken for the event. To view more information for a specific event, click **View Metadata** to expand the panel to view the following: - **Session Type**: The type of authentication for the event session. For example, this can be **bearer** (which is session-based) or **token** (which is token-based). - **Subject Role**: The role of the user account that generated this event. - **Session ID**: The audit session ID associated with this login session. - **App Identifier**: The application source associated with this audit session. - **Full Request URI**: The full URI of the API request sent for this event. - **API Request ID**: The API request ID for this audit event. - **Resource ID**: The unique ID of the resource that owns the audit log. - **HTTP Verb**: The HTTP request method used for the action. The most commonly used operations are **POST**,** GET**,** PUT**,** PATCH**,** and DELETE**. - **HTTP Response Code**: The HTTP status code that indicates whether the HTTP request associated with this event has been successfully completed**.** For example, code **200** indicates the request is successful. - **Event Summary** (details pane): Displays detailed information about all create, update, and delete (CUD) operations. The following CUD objects are supported: - External Networks - Endpoints - Mobile Endpoints - Endpoint Groups - Internal Domains - Security Policies - Custom Lists - Category Filters - Application Filters - Bypass Codes - DNS Forwarding Proxy - Authentication Profiles - On-Prem DNS Firewall Configuration When you toggle to the table view, the **Audit Logs** page can display some or all of the following fields. By clicking the hamburger menu next to the fields, you have the flexibility to select or deselect the fields (including associated tags) as well as their order to be displayed in the table view. - **TIMESTAMP**: The timestamp is based on the preferred time zone set on the User Profile page. When you select a time on the **Servers > Logs** page, the filters are applied according to the time zone set on the User Profile page. - **USER**: The name of the user account that performed the task. - **SOURCE IP**: The IP address of the source destination that initiated the task. - **RESOURCE TYPE**: The resource with which the performed task was associated. For example, if a user performed a specific task to a NIOS-X server, this field displays the name of the NIOS-X server. - **ACTION**: The specific action that was performed by the user. For example, if a user updated a the configuration of the NIOS-X server, this field displays **Update**; and if a user deleted tags on a NIOS-X server, this fields displays** Delete**. - **EVENT SUMMARY**: Displays information about the action that has been taken for the event. - **SUBJECT ROLE**: The role of the user account that generated this event. - **SESSION ID**: The audit session ID associated with this login session. - **APP IDENTIFIER**: The application source associated with this audit session. - **SESSION TYPE**: The type of authentication for the event session. For example, this can be **bearer** (which is session-based) or **token** (which is token-based). - **FULL REQUEST URI**: The full URI of the API request sent for this event. - **API REQUEST ID**: The API request ID for this audit event. - **RESOURCE ID**: The unique ID of the resource that owns the audit log. - **HTTP VERB**: The HTTP request method used for the action. The most commonly used operations are **POST**,** GET**,** PUT**,** PATCH**,** and DELETE**. - **HTTP RESPONSE CODE**: The HTTP status code that indicates whether the HTTP request associated with this event has been successfully completed**.** For example, code **200** indicates the request is successful. ## Downloading Audit Logs in CSV Format To download audit logs in CSV format, do the following: - On the **Audit Logs** page, click **Download**. The download file is in this format: *audit-log-the timestamp in UTC format.csv*, such as `audit-log-10-10-2022, 10-30-59 PM UTC.csv`. You can also do the following on the **Audit Logs** page: - Click the **Sort by** menu to choose the column by which you want to sort the events, and then use the up/down arrows to sort the events in ascending or descending order. - Enter the value that you want to search in the **Search** text box. Infoblox Portal displays the list of security events that match the keyword in the text box. ## Pulling a Support Bundle from Infoblox Portal You can also do the following on the **Audit Logs** page: - Uploading of log reports is not available for audit logs. - Uploading logs is not available for inactive endpoints.