Overview#

Audit logs are essential for tracking and monitoring actions within GritivaCore. They provide a comprehensive record of state-changing actions, logins, and permission checks, ensuring accountability and compliance.

Definition of Audit Logs#

Audit logs are records that capture every state-changing action (create, update, delete) on any resource, every login attempt, and every denied permission check within the GritivaCore platform.

Purpose of Audit Logs#

The primary purpose of audit logs is to maintain a secure and compliant environment by providing a detailed history of actions taken by users and systems. This is crucial for identifying unauthorized access and ensuring adherence to regulatory requirements.

Key Components#

Audit logs consist of several key components that provide detailed information about each logged event:

Event Types#

• State-changing actions (create, update, delete)
• Login attempts
• Permission checks (successful and denied)

Data Fields#

Each log entry includes the following fields:

• timestamp: When the event occurred
• actor_id: ID of the user or system that performed the action
• actor_type: Type of actor (user, system)
• action: The action performed
• resource_type: Type of resource affected
• resource_id: ID of the resource affected
• before_json: State of the resource before the action
• after_json: State of the resource after the action
• source_ip: IP address from which the action was initiated
• user_agent: User agent string of the client
• request_id: Unique identifier for the request

Common Use Cases#

Audit logs are commonly used for:

• Security monitoring and incident response
• Compliance audits (e.g., SOC2)
• User activity tracking
• Troubleshooting and debugging

Accessing Audit Logs#

Audit logs can be accessed by owners and administrators through the Audit page in the GritivaCore panel. Access is read-only; users cannot alter or delete audit entries.

Interpreting Audit Logs#

To interpret audit logs effectively, users should understand the schema and the significance of each data field. This enables them to analyze user actions and identify potential security issues.

Best Practices#

• Regularly review audit logs to identify unusual activities.
• Ensure logs are retained according to compliance requirements (Free: 7 days, Pro: 90 days, Enterprise: 1 year, configurable up to 7 years).
• Utilize CLI commands for efficient log management:
  • gritivactl audit list --since 24h --resource scope
  • gritivactl audit export --format ndjson > audit-2026-05.ndjson
• Export logs to external systems (S3, Splunk, Datadog) via webhook (audit.entry event).
• Ensure compliance with SOC2 CC7.2 requirements for audits.