Dashboard Audit Logs

Introduction

Tyk Dashboard’s audit log system captures detailed records of all requests made to endpoints under the /api route, providing a record of user activity via Dashboard API or in the UI. The audit logs can be written to local files or to the Control Plane’s persistent storage database, providing flexible options for log management and retrieval. See Enable and View Audit Logs in Tyk Dashboard for a step-by-step guide on using the audit log feature.

Enabling the Audit Log

The audit log is configured within the Tyk Dashboard config file (tyk_analytics.conf) or using the equivalent environment variables.

{
  "audit": {
    "enabled": true,
    "format": "json",
    "path": "/tmp/audit.log",
    "detailed_recording": false,
    "store_type": "file"
  }
}

Field	Description	Default
`enabled`	Enable audit logging.	`false`
`format`	Specifies the log format used when `store_type` is `file`. Valid values are `json` and `text`; ignored when `store_type` is `db`.	`text`
`path`	Path to the audit log file on the Dashboard’s server.
`detailed_recording`	Enable detailed records in the audit log. If set to `true`, audit log records will contain the http-request (without body) and full http-response including the body.	`false`
`store_type`	Specifies the storage in which audit logs will be written. Valid values are `file` and `db`.	`file`

Please consult Tyk Dashboard Configuration Options for equivalent configuration with environment variables.

Enabling detailed_recording captures the complete HTTP response body from every Dashboard API call. Depending on the endpoint, that response can include sensitive data, such as a newly generated API key, OAuth client secret, or other credentials returned by the call. This data is stored as-is in the audit log, wherever store_type points it. Enable this only when you need it, and make sure the resulting audit log has appropriate access controls.

The legacy setting security.audit_log_path can also be used to enable audit logging. This accepts a file path and combines the functionality of audit.enabled and audit.path. The value configured in audit.path will overrule anything set in security.audit_log_path.

Audit Log Storage

If audit.store_type is set to file, the logs will be added to the file identified using audit.path, in JSON or text format depending on the configuration of audit.format. In text format, each field is written on its own line, in the order listed in the table below.

If hosting Tyk Dashboard within a Kubernetes cluster, please ensure that the configured log file path is valid and writeable.

If audit.store_type is set to db, the logs will be added to a collection or table named audit_records in the Control Plane’s persistent storage, and audit.format is ignored: records are always stored in their native structured form, not as json or text. Database storage has been available since Tyk Dashboard v5.7.0.

Tyk does not manage the size of the audit log file or collection.

Audit Log Content

For each request made to the Tyk Dashboard API’s /api/* endpoints, a log will be generated containing the following data:

Field	Description
`_id`	Database identifier for the record, assigned when `store_type` is `db`. In `file` storage the record is never inserted into a database, so `json` format includes `_id` as an empty value and `text` format omits it entirely.
`req_id`	Unique request ID
`org_id`	Organisation ID
`date`	Date in RFC1123 format
`timestamp`	UNIX timestamp
`ip`	IP address the request originated from
`user`	Dashboard user who performed the request
`action`	Description of the action performed (for example, Update User)
`method`	HTTP request method
`url`	URL of the request
`status`	HTTP response status of the request
`diff`	Provides a diff of changed fields (available only for PUT requests)
`request_dump`	HTTP request copy (available if `detailed_recording` is set to `true`)
`response_dump`	HTTP response copy (available if `detailed_recording` is set to `true`)

Viewing and Retrieving Audit Logs

Tyk Dashboard’s System Management > Audit Logs screen provides a searchable and filterable view of the collected audit logs. The List Audit Logs endpoint, available since Tyk Dashboard v5.7.0, provides access to logs stored in the persistent storage.

Getting Started

Deploy Tyk

Design & Create APIs

Secure APIs

Control Traffic

Routing Traffic

Transform Traffic

Observe APIs

Maintain APIs

Platform Administration

Guides

Reference

Developer Support

Introduction

Enabling the Audit Log

Audit Log Storage

Audit Log Content

Viewing and Retrieving Audit Logs

​Introduction

​Enabling the Audit Log

​Audit Log Storage

​Audit Log Content

​Viewing and Retrieving Audit Logs

Introduction

Enabling the Audit Log

Audit Log Storage

Audit Log Content

Viewing and Retrieving Audit Logs