# Apigee Edge Auditing **URL:** \ **Category:** Knowledge Hub\ **Tags:** apigee\ **Created:** [June 28, 2016, 7:15am UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020 "2016-06-28T07:15:00Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ssvaidyanathan](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/ssvaidyanathan/32/52045_2.png) [@ssvaidyanathan](https://discuss.google.dev/u/ssvaidyanathan)\ **Post date:** [June 28, 2016, 7:15am UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020/1 "2016-06-28T07:15:00Z")
# Auditing ## ### Introduction: This article discusses the auditing capabilities and APIs that are available out of the box in Apigee Edge. Auditing is extremely important like any other component for a software or a platform. As an admin, you would want to know what are the different actions and events performed on the platform. In case of any issues, it is this feature that comes to the rescue or at least helps you track and narrow down the potential cause. Using auditing, you can check not only the calls made but also check the entitlements for each calling user. It is very important that the admins understand this and use it correctly. Below are the different aspects of Apigee Edge’s out-of-the-box auditing capabilities: - Logs a record for every call made to the management API and stores it in the Apigee Edge data store - These records can be viewed using: - Management UI - Management API - Audit logs are stored in Apigee Edge central data store and be viewed using: - [Apigee Management API](http://docs.apigee.com/api/audits-0) - [Apigee Enterprise UI](https://enterprise.apigee.com/) under Admin → Organization History - [Apigee Enterprise UI](https://enterprise.apigee.com/) under API Proxy → Project → API Proxy History - These records can be useful for CI/CD pipeline to understand the different deployments across various teams happening in each environment. - Useful to audit RBAC entitlements for different users of Apigee Edge (API Developers, non-human users used for deployments and automation, etc.) ### What is being logged as part of an audit? The following information is logged as part of an audit: - Operation: create, update, delete - Request URI - Request - Response code - User - Timestamp ### Can I get audit records just for a developer or any other entities? Apigee Edge Auditing gives you different levels of auditing as well. Depending on the audit requirements, you can pull the audits appropriately. The different levels of auditing are: - Developers (all, single) - Apigee Edge Users - Organization - API Products - API Proxies - Apps - Trace sessions ### Other Questions: - Can I get the audit for deployments? - Yes, there is an API. Refer to [this](https://community.apigee.com/questions/17679/audits-for-deployments.html) community post for additional information. - How do I get to know if there are new Organization users added in my Edge organization? - You can use the Audit API or UI to view the same. Please refer to the Reference section below - Is there any way we can log all the changes made in the KVM and configuration in API through the Management Console or via a script? - Yes, there is an audit API for this. If you query the audit trail, you will see changes in KVM, changes in API Proxies, proxy deployments and un-deployments, API Products, developers, developer apps, and so on. Refer to [this](https://community.apigee.com/questions/24059/is-there-any-way-we-can-log-all-the-changes-made-i.html) community post for additional information. ### Reference: Management API: [http://docs.apigee.com/api/audits-0](http://docs.apigee.com/api/audits-0) Apigee Audit Documentation: [http://docs.apigee.com/api-services/content/view-api-history](http://docs.apigee.com/api-services/content/view-api-history) Audit on the Edge UI looks like ![pFjB_7_Rmimkb-lF7q8Dup7PAFZwECYWF1VPDnNuq_E3fLsvQIThbmGYMogicA1gQWNASxAIjSCkPbRD_1MCUAiCkUuiR_-NXgI1QhTnj2R-U12Emak5a963-ABYEjSpkBcvxkyW](https://d2yds90mtvelsl.cloudfront.net/original/3X/d/5/d59ade609a9f4762f0613ef404119163353cc904.png) ![5J4P8lY9Yj1LQnZiEhs7rEcz3MSE6ixDbTToRYT0PeI7sIbVuCVIY7Ax9cEez6H5eYp3QLSn5-xiJgIOH2eROFFj1nwD4NtL8xgLz6zn1FOvIpfje0D2FSTLQZB4f3_rhEZH3yVr](https://d2yds90mtvelsl.cloudfront.net/original/3X/a/c/ace184809c14c4d6839248421d3f044c3049469a.png) ### ---
**Author:** ![kurtkanaskie](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/kurtkanaskie/32/140826_2.png) [@kurtkanaskie](https://discuss.google.dev/u/kurtkanaskie)\ **Post date:** [March 15, 2018, 2:08pm UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020/2 "2018-03-15T14:08:46Z")
Great article, is there a retention period on audit logs? ---
**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\ **Post date:** [June 18, 2018, 6:01pm UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020/3 "2018-06-18T18:01:32Z")
[@Sai Saran Vaidyanathan](https://community.apigee.com/users/3508/ssvaidyanathan.html) Where this org history is stored ? Is it cassandra? and is there a retention period ? ---
**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\ **Post date:** [January 28, 2019, 9:43am UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020/4 "2019-01-28T09:43:50Z")
Was this written before the official documentation came out? Because to me it looks like everything in this article can be found in the official documentation. I am interested in finding out the retention period for audit entries, if it can be configured and if what is audited can be configured too. But this information is missing from the official documentation too. ---
**Author:** ![ncardace](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/ncardace/32/34019_2.png) [@ncardace](https://discuss.google.dev/u/ncardace)\ **Post date:** [October 4, 2019, 1:00pm UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020/5 "2019-10-04T13:00:26Z")
Audit logs are stored in a dedicated Cassandra DB keyspace “audit” and table called “audits”. The audit entries are persisted forever and there is no job periodical activity to purge them by their age. If needed for compliance, this can be added as a daily purge, using the timestamp field. Audits schema is below: audit.audits ( key text PRIMARY KEY, clientip text, id text, operation text, request text, requesturi text, response text, responsecode text, serverhostname text, serverip text, timestamp bigint, type text, user text, “x-forwarded-for” text ) Additionally, audits\_ref reference table is below: audit.audits\_ref ( key text, column1 ‘org.apache.cassandra.db.marshal.DynamicCompositeType(org.apache.cassandra.db.marshal.UTF8Type, org.apache.cassandra.db.marshal.LongType)’, value blob, PRIMARY KEY (key, column1) ) ---
**Author:** ![sjm2000](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/sjm2000/32/16933_2.png) [@sjm2000](https://discuss.google.dev/u/sjm2000)\ **Post date:** [May 17, 2020, 2:08pm UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020/6 "2020-05-17T14:08:11Z")
[@Nicola](https://community.apigee.com/users/10232/ncardace-1.html) how do i integrate this log with a syslog? Any community post? Surely others must have done it. ---
**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\ **Post date:** [February 25, 2022, 12:58pm UTC](https://discuss.google.dev/t/apigee-edge-auditing/18020/7 "2022-02-25T12:58:21Z")
Hi, Is there a way we can see these History in logs ? I am looking for a way to see these updates getting stored at system level for monitoring ? Appreciate your assistance. Thanks