This section contains generic audit log information.
Query audit logs in Grail.
fetch logs | filter isNotNull(audit.action)
This section contains meta information on the audit log.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableAudited action. |
|
| string | stableUser name, service account name, or principal name that executes audited action. |
|
| string | stableResult of the audited action. |
|
| string | stableStatus of the audited action. |
|
| timestamp | experimentalTimestamp of the audited action. |
|
| boolean | experimentalReports whether the executant of the audited action has performed a multi-factor authentication. | |
| string | stableUnstructured content of the record. It should contain a human-readable message. Often it is the raw version of a record read from a source. |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableHuman-readable attribute that identifies a log stream. 1Tags: |
|
| string | stableThe log event severity level. |
|
| string | experimentalOverall significance of log event, derived from log level. Only INFO and NONE values are allowed. |
|
| timestamp | stableTime (UNIX Epoch time in nanoseconds) when the event originated, typically when the event was ingested into Dynatrace. |
|
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).
This section contains information on the audit log result.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalError code associated with the result. |
|
| string | experimentalFurther details regarding the result. |
|
| string | experimentalBrief message attached to the result. |
|
This section contains information on the client performing the audited action.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe name of the client application used to perform the request. |
|
| ipAddress | experimentalThe IP address of the client that makes the request. This may be IPv4 or IPv6.Tags: |
|
Information regarding the actor who peformed the audited action.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalEnglish name of the city from which the actor operates. |
|
| string | experimentalEnglish name of the country from which the actor operates. |
|
| string | experimentalThe approximate WGS84 latitude. |
|
| string | experimentalThe approximate WGS84 longitude. |
|
| ipAddress[] | experimentalList of IP addresses of the client (IPv4 or IPv6) from which the actor operates. |
|
Information regarding the device used by the identity peforming the audited action.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe browser name. |
|
| string | resource stableThe browser version. |
|
| string | experimentalGUID that uniquely identifies the device which is used to perform the audited action. |
|
| string | experimentalThe name associated with the device which is used to perform the audited action. |
|
| string | experimentalHuman-readable operating system name. |
|
The cloud provider information (if any) associated with the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalName of the cloud provider. |
|
The Azure tenant (if any) associated to the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalUnique, immutable identifier assigned to the Azure tenant. |
|
| string | resource experimentalName assigned to the Azure tenant. |
|
The AWS account (if any) associated to the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: |
|
| string | resource experimentalName associated with the AWS account. |
|
The GCP organization (if any) associated to the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalUnique, immutable identifier assigned to an organization resource. |
|
| string | resource experimentalName assigned to the GCP organization. |
|
This section contains general log information. There can be additional records added both resource attributes describing source as well as log record attributes to add structured log record data.
Query logs in Grail.
fetch logs
The log module, in certain situations, may associate multiple process group instances with a single log.
This can occur when more than one process group instance opens a file in write mode or if there are multiple
process group instances in a single container. In such cases, the
dt.entity.process_group_instance and dt.entity.process_group
may be reported as arrays. To prepare queries for such situations, use matchesValue
instead of == for equality checks.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableUnstructured content of the record. It should contain a human-readable message. Often it is the raw version of a record read from a source. |
|
| string | resource stableThe entity ID of the process group that has emitted the log.Note that the log module may report multiple values as an array if a file is opened by multiple processes or multiple processes are run in a single container. To prepare queries for such situations, use |
|
| string | resource stableThe entity ID of the process group that has emitted the log.Note that the log module may report multiple values as an array if a file is opened by multiple processes or multiple processes are run in a single container. To prepare queries for such situations, use |
|
| string | resource stableThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 1Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableThe I/O stream to which the log was emitted. |
|
| string | stableHuman-readable attribute that identifies a log stream. 2Tags: |
|
| string | stableThe log event severity level. |
|
| string[] | stableTechnologies detected for the process. |
|
| string | experimentalA unique identifier for a span within a trace. The |
|
| string | experimentalOverall significance of log event, derived from log level. Only INFO, WARN, ERROR and NONE values are allowed. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | experimentalA unique identifier for a trace. The |
|
The value of this field will be based on one of the dt.entity.<type> fields value. This means that both dt.source_entity and dt.entity.<type> fields will be set to the same ID.
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).