Audit logs - User Guide - BlueCat Horizon

All applications on the platform generate their own audit logs in a standard format. This data is sourced from the DDI orchestrator service, the identity service, and Connection hub.

System logs, with events expanded to display more information.

Under Audit logs, you can select a log type to view available audit data. There are several log types:

User logs: User logs track any changes made by users to objects in the system, either through the UI or API.
System logs: Any changes made by BlueCat Horizon and its applications to objects in the system, such as updates to DDI agents, are logged.
HTTP logs: HTTP logs track Post, Put, Patch, and Delete HTTP events on BlueCat Horizon.
Authentication logs: BlueCat Horizon logs every login by a user or API token via the platform or API.

All audit data is retained for a default of 30 days. To purchase a longer storage period, please contact your sales representative.

User logs

To view user logs, select User under Audit logs in the navigation menu. For each entry in the user logs, the following information is displayed:

Timestamp: The date and time that the change was made.
Identity: The name of the user or API token that initiated the change.
Application: The part of the BlueCat Horizon in which the change was made, such as Platform or DDI orchestrator.
Action type: The action for which the log was generated, such as Add, Delete, or Update.
Object type: The type of resource that was changed, such as User, Token, or DNS zone.
Object name: The name of the resource in the system affected by the change.

Expand an entry to view more details, including the following:

ID: ID of the user or API token that initiated the change.
Request ID: Identifier of the HTTP request for which the log was generated.
Identity type: Indicates whether the change was made by a User or API token.
Source IP: IP of the user or API token that initiated the change.
Session ID: Identifier of the login session within which the change was made.
Event text: A description of the change.
Save comment: Comment provided by the user for the change.
Changes: Selecting the Show object button opens a window that displays the object's configuration after the change was made.
Note: For changes made in DDI orchestrator application, the Event text field describes the changes, not the Changes field.

System logs

To view system logs, select System under Audit logs in the navigation menu. For each entry in the system logs, the following information is displayed:

Timestamp: The date and time that the change was made.
Application: The part of the BlueCat Horizon in which the change was made, such as Platform or DDI orchestrator.
Action type: The action for which the log was generated, such as Add or Delete.
Object type: The type of resource that was changed, such as User, Connection, or IP address.
Object name: The name of the resource in the system affected by the change. Select the Copy reference icon to copy the object reference, that is the reference to the resource affected by the change.

Expand an entry to view more details, including the following:

ID: ID of the user or API token that initiated the change.
Request ID: Identifier of the HTTP request for which the log was generated.
Event text: A description of the change.
Changes: Selecting the Show changes button opens a window that displays the object's configuration before the change was made.

Note: For changes made in DDI orchestrator application, the Event text field describes the changes, not the Changes field.

HTTP logs

To view HTTP logs, select HTTP under Audit logs in the navigation menu. For each entry in the HTTP logs, the following information is displayed:

Timestamp: The date and time that the change was made.
Application: The part of the BlueCat Horizon in which the change was made, such as Platform or DDI orchestrator.
Action type: The action for which the log was generated, such as Post or Put, or Delete.
Object type: The type of resource that was changed, such as User, Role, or Group.
Source IP: IP of the user or API token that initiated the change.
R. code: Response code

Expand an entry to view more details, including the following:

ID: ID of the user or API token that initiated the change.
Request ID: Identifier of the HTTP request for which the log was generated.
Session ID: Identifier of the login session within which the change was made.
Identity: ID of the user or API token that initiated the change.
Identity type: Indicates whether the change was made by a User or API token.
HTTP path: The HTTP request path
HTTP duration: The HTTP request duration in milliseconds
HTTP request size: The number of bytes in the HTTP request
HTTP response size: The number of bytes in the HTTP response

Authentication logs

To view authentication logs, select Authentication under Audit logs in the navigation menu. For each entry in the authentication logs, the following information is displayed:

Timestamp: The date and time that the login/logout action occurred.
Application: The part of the BlueCat Horizon that was logged into or out of, such as Platform or DDI orchestrator.
Action type: The action for which the log was generated, such as Login.
Object type: The type of resource for which the log was generated, such as User.
Identity: ID of the user or API token that authenticated. Select the Copy ID icon to copy the user or API token ID.

Expand an entry to view more details, including the following:

ID: ID of the user or API token that authenticated.
Request ID: Identifier of the HTTP request for which the log was generated.
Identity type: Indicates whether a User or API token authenticated.
Source IP: IP of the user or API token that authenticated.
Session ID: Identifier of the login session within which the login/logout action occurred.

Viewing audit logs

When viewing audit logs, you can manage the data the platform displays using filters. For more information about using filters, refer to Filtering audit logs.

To make sure you're viewing the most up-to-date logs, select the Refresh icon The Refresh icon in the top right corner of the list. Selecting this icon will refresh the audit logs displayed in the list, so that any events that occurred after you opened the page will now be displayed.