> ## Documentation Index
> Fetch the complete documentation index at: https://tyk.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Dashboard Audit Logs
> Learn how to configure Tyk Dashboard to log user activity
## Introduction
Tyk Dashboard's audit log system captures detailed records of all requests made to endpoints under the `/api` route, providing a record of user activity via Dashboard API or in the UI. The audit logs can be written to local files or to the Control Plane's persistent storage database, providing flexible options for log management and retrieval.
See [Enable and View Audit Logs in Tyk Dashboard](/docs/api-management/enable-audit-logs-dashboard) for a step-by-step guide on using the audit log feature.
### Enabling the Audit Log
The audit log is configured within the Tyk Dashboard config file (`tyk_analytics.conf`) or using the equivalent environment variables.
```json theme={null}
{
"audit": {
"enabled": true,
"format": "json",
"path": "/tmp/audit.log",
"detailed_recording": false,
"store_type": "file"
}
}
```
| Field | Description | Default |
| :------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------ |
| `enabled` | Enable audit logging. | `false` |
| `format` | Specifies the log format used when `store_type` is `file`. Valid values are `json` and `text`; ignored when `store_type` is `db`. | `text` |
| `path` | Path to the audit log file on the Dashboard's server. | |
| `detailed_recording` | Enable detailed records in the audit log. If set to `true`, audit log records will contain the http-request (without body) and full http-response including the body. | `false` |
| `store_type` | Specifies the storage in which audit logs will be written. Valid values are `file` and `db`. | `file` |
Please consult [Tyk Dashboard Configuration Options](/docs/tyk-dashboard/configuration#audit) for equivalent configuration with environment variables.
Enabling `detailed_recording` captures the complete HTTP response body from every Dashboard API call. Depending on the endpoint, that response can include sensitive data, such as a newly generated API key, OAuth client secret, or other credentials returned by the call. This data is stored as-is in the audit log, wherever `store_type` points it. Enable this only when you need it, and make sure the resulting audit log has appropriate access controls.
The legacy setting [`security.audit_log_path`](/docs/tyk-dashboard/configuration#security-audit_log_path) can also be used to enable audit logging. This accepts a file path and combines the functionality of `audit.enabled` and `audit.path`. The value configured in `audit.path` will overrule anything set in `security.audit_log_path`.
### Audit Log Storage
If `audit.store_type` is set to `file`, the logs will be added to the file identified using `audit.path`, in JSON or text format depending on the configuration of `audit.format`. In `text` format, each field is written on its own line, in the order listed in the [table below](#audit-log-content).
If hosting Tyk Dashboard within a Kubernetes cluster, please ensure that the configured log file path is valid and writeable.
If `audit.store_type` is set to `db`, the logs will be added to a collection or table named `audit_records` in the Control Plane's persistent storage, and `audit.format` is ignored: records are always stored in their native structured form, not as `json` or `text`. Database storage has been available since [Tyk Dashboard v5.7.0](/docs/developer-support/release-notes/dashboard#5-7-0-release-notes).
Tyk does not manage the size of the audit log file or collection.
## Audit Log Content
For each request made to the Tyk Dashboard API's `/api/*` endpoints, a log will be generated containing the following data:
| Field | Description |
| :-------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `_id` | Database identifier for the record, assigned when `store_type` is `db`. In `file` storage the record is never inserted into a database, so `json` format includes `_id` as an empty value and `text` format omits it entirely. |
| `req_id` | Unique request ID |
| `org_id` | Organisation ID |
| `date` | Date in *RFC1123* format |
| `timestamp` | UNIX timestamp |
| `ip` | IP address the request originated from |
| `user` | Dashboard user who performed the request |
| `action` | Description of the action performed (for example, Update User) |
| `method` | HTTP request method |
| `url` | URL of the request |
| `status` | HTTP response status of the request |
| `diff` | Provides a diff of changed fields (available only for PUT requests) |
| `request_dump` | HTTP request copy (available if `detailed_recording` is set to `true`) |
| `response_dump` | HTTP response copy (available if `detailed_recording` is set to `true`) |
## Viewing and Retrieving Audit Logs
Tyk Dashboard's **System Management > Audit Logs** screen provides a searchable and filterable view of the collected audit logs.
The [List Audit Logs](https://tyk.io/docs/api-reference/auditlogs/list-audit-logs) endpoint, available since [Tyk Dashboard v5.7.0](/docs/developer-support/release-notes/dashboard#5-7-0-release-notes), provides access to logs stored in the persistent storage.