Audit logs are crucial for tracking changes and security-relevant events. Dynatrace can log such events so that you can review important changes: when the change was made, by whom, and what was changed.
The following events are logged:
The environment audit log records configuration changes and API requests. Ingested records are not audit events, whether the data arrives through the REST ingest endpoints (for example, /api/v2/metrics/ingest, /api/v2/logs/ingest, and OTLP endpoints), through OneAgent, or through an ActiveGate. Changes to the ingest configuration are recorded as configuration changes.
Changes to OAuth tokens and changes to Account Management configuration, such as SSO, are outside the scope of the environment audit log. See Account Management audit logs for account-level identity and access management changes, or Audit logs overview for a comparison of the Dynatrace audit logs.
Audit logs include personal identifiable information (PII) such as email addresses and IP addresses of Dynatrace users.
🔴 Disabled by default
To enable audit logging
Dynatrace retains audit logs for 30 days and automatically deletes them afterwards.
You can also enable audit logs via Data privacy API.
You can access environment-wide audit logs via the GET audit log API call.
If you're moving to Latest Dynatrace, see Upgrade from classic audit logs to Grail-based audit queries for how to query these events in Grail instead.