# Access and Consume Audit Logs on Confluent Cloud Audit logs are automatically enabled for each Standard, Enterprise, Dedicated, or Freight cluster. You can typically access your audit logs within five minutes of successfully provisioning your cluster. Basic clusters do not include audit logs. You can filter audit logs when you view them in the Confluent Cloud Console or set them up for consumption. Live audit log records are automatically deleted after seven days. To retain audit logs beyond this period, replicate them to another Apache Kafka® cluster or an external system using Cluster Linking or a Kafka client. For details, see [Retain Audit Log Records on Confluent Cloud](retain-audit-logs.md#retain-audit-log-records). ## Prerequisites - **Cluster type**: You must have a Standard, Enterprise, Dedicated, or Freight Kafka [cluster](../../clusters/cluster-types.md#cloud-cluster-types), as audit logs for these types are enabled by default. Basic clusters do not include audit logs. - **Kafka client or Confluent Cloud Console**: You can view audit log events in the Cloud Console or use any [Kafka client](https://docs.confluent.io/platform/current/clients/index.html), such as the Confluent CLI, [C/C++](https://docs.confluent.io/cloud/current/client-apps/config-client.html#librdkafka-based-c-clients), or [Java](https://docs.confluent.io/cloud/current/client-apps/config-client.html#java-client) to consume data from the Confluent Cloud audit log topic as long as the client supports Simple Authentication and Security Layer (SASL) authentication. The Cloud Console provides a configuration you can copy and paste into your Kafka client of choice. With this configuration, you can connect to the audit log cluster, which is the dedicated cluster that stores your organization’s audit log events, and consume from the audit log topic. - **Permissions**: To view audit logs in the Confluent Cloud Console, you must have the [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) role. To consume audit logs using any Kafka client, you must have an API key and secret for the audit log cluster. An [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) role must create the API key and secret for the audit log cluster. After creation, any user can use the API key to consume audit logs. The API key is bound only to the audit log cluster. ## View your audit logs You can view and access your audit logs in the Confluent Cloud Console. To do this, you must have the [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) role, and your organization must have at least one Standard, Enterprise, Dedicated, or Freight Kafka [cluster](../../clusters/cluster-types.md#cloud-cluster-types). For more information about the events that display in the Cloud Console, see [Events displayed by default](cloud-audit-log-categories.md#audit-logs-display-categories). 1. In Cloud Console, open the Administration menu. Below the current user name, select **Audit logs**. ![image](images/_monitoring/audit-log-admin-menu.png) 2. Filter the audit logs to find the information you need: * Principal, subject, or IP address * Period of time, by minutes, hours, or days, up to the last seven days * Method, such as authentication * Authorization, filtered by **Allow** or **Deny** You can also select a row to see the log content and fields for a specific event. 3. You can export audit events or logs that are displayed in the Cloud Console. - To export a log, click **Actions**. Download the audit log as a CSV or JSON file. - To export an event, select it in the **Timestamp** column. In the panel that opens, click **Download** to download the audit log event as a CSV or JSON file. Alternatively, you can consume your audit log using these tools: - [Confluent CLI](#cloud-audit-logs-consume-cli) - [Java](#cloud-audit-logs-consume-java) - [C/C++](#cloud-audit-logs-consume-cc) ## Consume with Confluent CLI Use the `confluent kafka topic consume` command to consume audit log events with the Confluent CLI. An [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) must first create an API key and secret for the audit log cluster. After creation, any user can use that key. 1. Open a terminal and log in to your Confluent Cloud organization. ```text confluent login ``` 2. Run the `confluent audit-log describe` command to identify which resources to use. The following example shows the audit log information provided for a sample cluster. ```text confluent audit-log describe +-----------------+----------------------------+ | Cluster | lkc-yokxv6 | | Environment | env-abc123 | | Service Account | sa-ymnkzp | | Topic Name | confluent-audit-log-events | +-----------------+----------------------------+ ``` #### NOTE The topic `confluent-audit-log-events` cannot be viewed in the Confluent Cloud Console, but you can consume it using the Confluent CLI or any Kafka client. The Service Account in the output is only for information. The Service Account does not need to be used when creating API keys for the audit log cluster. 3. Specify the environment and cluster to use by running the `confluent environment use` and `confluent kafka cluster use` commands. The environment and cluster names are available from the data retrieved in the previous step. ```text confluent environment use env-abc123 confluent kafka cluster use lkc-yokxv6 ``` 4. If you have an existing API key and secret for your audit log cluster, you can store it locally using the `confluent api-key store` command. ```text confluent api-key store --resource lkc-yokxv6 ``` To view the existing API keys for your audit log cluster, run the `confluent api-key list` command using the `--resource` option. ```text confluent api-key list --resource lkc-yokxv6 ``` #### NOTE To consume data from the audit log topic, you must have an API key and secret. 5. If you need to create a new API key and secret for your audit log cluster, run the `confluent api-key create` command with the `--resource` flag. Be sure to save the API key and secret. You cannot retrieve the secret later. ```text confluent api-key create --resource lkc-yokxv6 ``` #### IMPORTANT To get the identifier for the audit log cluster, run the Confluent CLI `confluent audit-log describe` command. There is a limit of two API keys per audit log cluster. If you need to delete an existing API key for your audit log cluster, run the following command: ```text confluent api-key delete ``` 6. After creating your API key and secret, copy the API key and paste it into the following command: ```text confluent api-key use --resource lkc-yokxv6 ``` 7. Consume audit log event messages from the audit log topic. You can use the Confluent CLI to consume audit log events from the audit log cluster by running the following `confluent kafka topic consume` command: ```text confluent kafka topic consume -b confluent-audit-log-events ``` For details about the options you can use with this command, see [confluent kafka topic consume](https://docs.confluent.io/confluent-cli/current/command-reference/kafka/topic/confluent_kafka_topic_consume.html). New connections using a deleted API key are not allowed. To rotate keys: 1. Create a new key. 2. Configure your clients to use the new key. 3. Delete the old key. To watch authentication events as they occur and see which Kafka cluster API keys are in use, run the following commands: ```text confluent kafka topic consume confluent-audit-log-events > audit-events.json & tail -f audit-events.json \ | grep 'kafka.Authentication' \ | jq .data.authenticationInfo.metadata.identifier \ > recently-used-api-keys.txt & tail -f recently-used-api-keys.txt ``` #### NOTE The [jq](https://stedolan.github.io/jq/) command-line JSON processor is third-party software that is not included or installed in Confluent Cloud. If you wish to use it, you must download and install it yourself. ## Consume with Java Use a Java Client to consume audit log events from the audit log cluster. An [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) role must first create the API key and secret. After creation, any user can use that key. 1. Sign in to Confluent Cloud Console at [https://confluent.cloud](https://confluent.cloud). 2. From the Administration menu, select **Audit logs**. 3. On the **Audit logs** page, click **Consume Logs**. Then, in the **Consume Logs** panel, select the **Consume with Java** tab. ![image](images/_monitoring/audit-log-consume-java.png) 4. Copy and paste the provided configuration into your client. 5. If necessary, click **Create Kafka cluster API key & secret** to create a key and secret pair for your Kafka cluster. 6. Start and connect to the Java client. ## Consume with C/C++ 1. Sign in to Confluent Cloud Console at [https://confluent.cloud](https://confluent.cloud). 2. From the Administration menu, select **Audit logs**. 3. On the **Audit logs** page, click **Consume Logs**. Then, in the **Consume Logs** panel, click the **Consume with C/C++** tab. ![image](images/ccloud-audit-log-consume-c++.png) 4. Copy and paste the provided configuration into your client. 5. If necessary, click **Create Kafka cluster API key & secret** to create an API key and secret for your Kafka cluster. 6. Start and connect to the C/C++ client. ## Securing Confluent Cloud audit logs Secure your organization’s audit logs by protecting the API keys used to read them. API keys specific to the audit log cluster are the only means of gaining read-only access. The destination cluster is located on a public cluster in AWS `us-west-2` with encrypted storage and a default Key Management Service (KMS) key rotation schedule of every three years. Confluent Cloud supports up to two active audit log cluster API keys at a time, and allows live key rotation. For API key best practices, see [Best Practices for Using API Keys on Confluent Cloud](../../security/authenticate/workload-identities/service-accounts/api-keys/best-practices-api-keys.md#api-keys-best-practices). ## Accessing audit log messages from behind a firewall Audit log clusters don’t have a static IP address, so allowlist the full Confluent Cloud IP range instead of a single address. For information about configuring firewall access to public clusters, see [IP addresses for public endpoints](../../networking/overview.md#cloud-ip-addresses-not-static). ## Related content - [Best Practices for Audit Logs on Confluent Cloud](best-practices.md#best-practices-cloud-audit-logs) - [Audit Log Event Records on Confluent Cloud](audit-log-records.md#cloud-audit-log-records) - [Audit Log Event Categories on Confluent Cloud](cloud-audit-log-categories.md#cloud-audit-log-categories)