Dynatrace has multiple audit logs, and none of them covers everything. Each log answers a different question, retains data for a different length of time, and is accessed in a different way. Use this page to work out which one you need.
| Audit log | Dynatrace version | Records | Retention | How to access |
|---|---|---|---|---|
| Audit logs on Grail | Latest Dynatrace | Environment settings changes and Dynatrace API gateway requests | 1 year | DQL query against dt.system.events |
| Audit logs via API | Dynatrace Classic | Environment configuration changes, API token changes, logins and logouts in Dynatrace Classic | 30 days | v2/auditlogs REST API, or the Cluster Management Console on Dynatrace Managed |
| Account Management audit logs | Dynatrace Classic and Latest Dynatrace | Account-level identity and access management changes, and budget, forecast, and cost settings | 10 years | Account Management > Settings > Audit log, or the Account Management API |
Audit events cover configuration changes, Dynatrace API gateway requests, and account-level changes. Ingested records are not audit events, whether the data arrives through the API ingest endpoints, through OneAgent, or through an ActiveGate. Changes to ingest configuration are recorded as settings changes.
Audit events from within platform services, such as an app being installed by AppEngine or a document being shared, aren't recorded yet.
Dynatrace Classic retrieves audit events through the v2/auditlogs endpoint. In Latest Dynatrace, the same events are queryable in Grail with DQL, alongside your logs, metrics, and traces.
To move an integration, script, or compliance export across, see Upgrade from classic audit logs to Grail-based audit queries.