Audit logs on Grail

• Latest Dynatrace
• How-to guide
• 1-min read
• Updated on Oct 14, 2026

Dynatrace provides built-in audit logging powered by Grail. Audit events are stored as dt.system.events in the dt_system_events bucket, retained for one year, and can be queried with standard DQL queries.

Audit events cover changes to the settings of your environment and requests that reach the Dynatrace API gateway, including logins and logouts. Audit events from within platform services, such as an app being installed by AppEngine or a document being shared, aren't recorded yet.

Enable audit logging

Grail-based audit logging is active by default in all Dynatrace environments.

Permissions

The following table describes the required permissions to access the audit logs.

For more details, refer to IAM policy reference.

How to filter audit logs

The dt_system_events bucket contains other system events as well as audit events, so every audit query has to filter by event.kind == "AUDIT_EVENT":

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"

Narrow that down with event.provider. To list every provider present in your environment, with the number of events from each:

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"
| summarize count = count(), by:{event.provider}

Filter events related to system settings changes

To filter for events that are related to changes or actions performed within the settings of the system, use the following query:

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"
| filter event.provider == "SETTINGS"

Changes to ingest configuration are recorded here too, because OpenPipeline configuration is stored in environment settings. For how ingest is configured, see How to ingest data (events).

Filter API gateway requests

To filter for requests that reached the Dynatrace API gateway, use the following query:

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"
| filter event.provider == "API_GATEWAY"

Ingest endpoints don't route through the gateway, so ingested records are not audit events.

Filter Dynatrace Notebooks system events

To filter system events to provide details about audit events specifically from changes to Dynatrace Notebooks, use the following query:

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"
| filter event.provider == "API_GATEWAY"
| filter contains(resource, "documents")
| filter app.id == "dynatrace.notebooks"
| filter event.type == "PATCH"

Filter Document Management audit events

To filter audit logs for administrator actions made in the Document Management settings widget:

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"
| filter event.provider == "DOCUMENTS"
| sort timestamp DESC

Retrieve user information from a user ID

Grail-based audit logs store the user ID instead of an email address to comply with data privacy regulations.

You can use a platform API to retrieve user details by providing the environment or account ID and the user ID. For example:

GET /platform/iam/v1/organizational-levels/{level-type}/{level-id}/users/{uuid}

export default async function () {
  var environmentID = "<environment-id>";
  var userID = "<user-id>";
  var myUrl = '/platform/iam/v1/organizational-levels/environment/'+environmentID+'/users/'+userID;
  var myResponse= fetch(myUrl)
    .then((response) => response.json())
    .then((data) => data.email);
  return myResponse;
}