Skip to main content
API7.ai Logo
Version: 3.10.x

Audit Logging

API7 Gateway audit logs help operators investigate supported administrative changes, trace configuration problems to the user or token that initiated them, and produce evidence for compliance reviews. Recorded entries can include the operator, event time, affected resource, request and response context, source IP address, and gateway group.

API7 Gateway records covered administrative operations performed through the Dashboard, Admin API, and ADC. See Audit Logs for coverage limitations and sensitive-data handling.

How Audit Logging Works​

The Dashboard and Admin API support viewing and exporting audit logs, but do not provide an operation for editing them. Protect the Control Plane database against direct modification or deletion.

For each recorded operation, the audit log includes the operation time, operator, event type, resource details, source IP address, and source of the operation.

Users with permission to view and download audit logs, such as auditors, can access detailed information and export the logs in JSON or CSV format for further analysis.

Treat audit logs as sensitive data. Audit logs are retained for 60 days by default, and the retention period is configurable.

Through the audit logging feature, users can promptly identify and address potential security threats, and effectively enhance the platform's security and compliance.

Key Features​

  • Record supported authenticated administrative operations with operator and request context.
  • Implement fine-grained audit log access control, ensuring only authorized administrators can view logs.
  • Audit logs are retained for 60 days by default, with a configurable retention period for auditing and regulatory requirements.

Use Cases​

Real-Time Detection and Recording​

Consider a scenario where a user mistakenly configures a new API service, leading to service disruption. If the change is covered by audit logging, API7 Gateway records it with the operator and request context.

When auditors log into the system and review the audit logs, they can quickly identify any anomalies or configuration errors that contributed to the disruption. The audit logging feature enables them to pinpoint issues promptly and take corrective action before any significant damage occurs. The real-time detection and recording of such events provide a proactive approach to managing security and operational risks.

Post-Event Audit Logs Analysis​

The detailed recording and auditing of critical operations provide a basis for subsequent compliance audits. These logs offer insights into user actions, system changes, and potential security incidents, making them invaluable for assessing adherence to security policies and regulatory requirements.

Through post-event analysis, administrators can easily and efficiently conduct targeted security audits on information systems. Moreover, the insights gained from post-event audits not only help in immediate issue resolution but also inform future policy adjustments and improvements. This makes audit logs a cornerstone for continuous security monitoring, risk management, and regulatory compliance.