Troubleshoot Audit Logging on Confluent Cloud

Use these tips to troubleshoot audit logging issues.

Cluster not sending audit log events

Audit logs are available on Standard, Enterprise, Dedicated, and Freight clusters only. If you are using a Basic cluster type, consider upgrading.

Altered topic without authorization missing from audit log

Some administration tools attempt to describe a resource before creating, altering, or deleting it. If the describe request fails or is rejected, the tool might not send a second request, so the alter request never happens. If you attempted to alter a topic on a Dedicated cluster but don’t see it in the audit log messages, the logs include an authentication event but no additional authorization check, because the alter request was never made.

Newly created topic does not appear in audit log messages

When a cluster-level permission check succeeds, the audit log event includes only the ID of the cluster, not the topic name, because the cluster-level check doesn’t reference specific topics. The API checks topic-creation permission in two steps:

The API checks for cluster-level permission to create any topic.
If the first check fails, the API then checks permission on the specific topic name or a prefix of that name.

Unfamiliar names appear in authorization checks

You might find several CreateTopics authorization checks with topic names that you don’t recognize or that don’t exist. When logged in to the Confluent Cloud Console, certain pages commonly perform “dry-run” permission checks in the background to check permissions and show only the controls that are relevant to the logged-in user. The authentication and authorization checks for these dry-run requests are logged. They typically have a resourceName that looks like crn:///kafka=lkc-abcde/topic=341e9e2e-f734-439d-8469-4433ce7f627c.

Authentication failures do not appear in audit log messages

Confluent Cloud only forwards an authentication failure to your audit logs when a connection uses one of your valid, active API keys with an incorrect secret. Confluent Cloud logs all other authentication failures internally, but doesn’t pass them to your audit logs.

Audit log messages include identifiers with no descriptions

If you come across audit log messages that use identifiers with no descriptions, for example, User:12345, run one of the following commands:

confluent iam user list
confluent api-key list
confluent iam service-account list

Describe command output is empty

You can run the confluent audit-log describe command and see no output, even when your organization has audit logging enabled. In such cases, the Confluent CLI might have cached your organization’s information before you enabled audit logging. To refresh the cache, run the following command:

confluent login --prompt

Audit log messages missing for producer and consumer requests

Audit log messages include the authentication events from when the producers and consumers connect, but not the produce and consume requests themselves.