Retain Audit Log Records on Confluent Cloud
Audit log records are retained for seven days on an independent Confluent Cloud cluster. They cannot be modified, deleted, or produced directly to the audit log topic. To retain records longer than seven days or modify them for analytics, export or replicate the data to an external Apache Kafka® cluster or other datastore.
Export audit log records using a self-managed sink connector
You can export your Confluent Cloud audit log data from your audit log cluster’s topic confluent-audit-log-events to an external target data store using a self-managed sink connector for Confluent Platform.
Important
Confluent Cloud audit logs cannot be consumed using Confluent Cloud fully managed sink connectors.
To use a self-managed sink connector to export audit log data, add consumer.override.bootstrap.servers to the connector’s config.properties file. This bootstraps the connector to your target cluster. The Confluent Cloud audit log cluster is read-only, so you must use the consumer override, or you receive a TopicAuthorizationException: Not authorized to access topics error.
For an example that exports Confluent Cloud audit log data using the self-managed Splunk sink connector, see the Confluent blog How to Visualize Confluent Cloud Audit Log Data. The example displays the data for analysis in two dashboards: “Confluent Cloud Audit Overview” and “Confluent Cloud Role Assignments”.
Replicate audit log data into a managed Kafka cluster
Sync your audit logs to a managed Kafka cluster in Confluent Cloud using Cluster Linking or Replicator to use fully managed tools, such as ksqlDB, Connect, and Stream Governance, and manage security with role-based access control (RBAC) and API keys.
For a step-by-step guide on using Cluster Linking to sync your audit logs into Dedicated or Enterprise Confluent Cloud clusters, see Use Cluster Linking to Manage Audit Logs.
To sync your audit logs to Standard Kafka clusters in Confluent Cloud, you can use Replicator.