Audit Logs
Export a timeline of material actions performed by your organization.
With a Render Organization or Enterprise plan, admins can export audit logs of material events performed by team members over a specified time frame. Audit logs help you meet the requirements of various regulatory standards.
Exporting audit logs
You can export an audit log of workspace events for an individual workspace. With an Enterprise plan, you can also export a separate audit log of Enterprise events for your org.
Select a tab to view instructions for each type of audit log:
Only workspace admins can export these audit logs.
-
In the Render Dashboard, navigate to your workspace's Workspace Settings page.
-
Scroll down to the Compliance section.
-
Under Audit Logs, select a start and end date, then click Export as CSV:
This audit log includes the event types listed under Workspace events.
Availability of audit log data
- Render begins retaining audit log data for your team as soon as you upgrade to an Organization or Enterprise plan.
- Event data from prior to upgrading is not available.
- Audit log data is available from June 24, 2024 onward if you upgraded to an Organization or Enterprise plan before that date.
- Whenever Render adds a new audit log event type, tracking for that event begins on the date of the event's introduction.
Audit log format
Audit logs are exported as a chronologically ordered CSV file with a separate row for each distinct event. The file includes the following columns:
| Column | Description |
|---|---|
|
timestamp |
The UTC timestamp when the event occurred. |
|
actor |
The entity that performed the action. Depending on the type of actor, this value has one of two formats:
|
|
event |
The type of event that occurred. See below for all supported workspace events and Enterprise events. |
|
status |
Indicates whether the event's associated action succeeded. One of the following values:
|
|
metadata |
A JSON object containing additional details about the event. The fields of this object vary depending on the event type. |
Workspace events
The event types below appear in audit logs for individual Render workspaces.
Member management
A workspace member's role was changed.
The workspace's set of allowed login methods was changed.
Currently, a workspace can either allow all Render-supported login methods or require login via Google account.
Two-factor authentication (2FA) enforcement was enabled or disabled for the workspace.
Apps & services
Render does not log events for services belonging to a service preview or preview environment.
A web service, private service, background worker, or static site was suspended.
A previously suspended web service, private service, background worker, or static site was resumed.
Maintenance mode was toggled for a web service.
In the event's metadata, the to field is true if maintenance mode was enabled and false if it was disabled.
The URL of a web service's maintenance mode page was changed.
The name of a web service, private service, background worker, static site, or cron job was changed.
A service was accessed via SSH, either from the command line or from the service's Shell page in the Render Dashboard.
A new Blueprint was created and applied to the workspace.
Datastores
General
Render Postgres
These events are logged only for primary Render Postgres instances, not for high availability standby instances or read replicas.
A Render Postgres database was created.
A Render Postgres database was deleted.
A Render Postgres database was suspended.
A previously suspended Render Postgres database was resumed.
A logical backup of a Render Postgres database was downloaded.
The connection URL or password for a Render Postgres database was viewed.
Render Key Value
A Render Key Value instance was created.
A Render Key Value instance was deleted.
The connection URL or password for a Render Key Value instance was viewed.
Persistent disks
The persistent disk for a web service, private service, or background worker was created.
The persistent disk for a web service, private service, or background worker was deleted.
The persistent disk for a web service, private service, or background worker was restored to a snapshot.
Environment variables
One or more existing environment variables were modified for a service.
One or more environment variables were created for a service.
One or more environment variables were deleted for a service.
One or more environment variable values were viewed for a service.
An environment group was deleted.
Webhooks
A webhook was created.
A webhook was changed.
A webhook was deleted.
Metrics
A metrics stream was created.
A metrics stream was deleted.
A metrics stream was changed.
Projects & environments
A project was created.
This event is always accompanied by one CreateEnvironmentEvent event, because every project is created with a default environment.
A project was deleted.
This event is always accompanied by at least one DeleteEnvironmentEvent event, because deleting a project also deletes all of its associated environments.
A resource (such as a service or environment group) was moved into or out of a project environment.
Protected access was enabled or disabled for a project environment.
Compliance & documents
A workspace member downloaded a document from the Render Document Center.
Enterprise events
The event types below are specific to Enterprise orgs. They pertain to SSO and other org-level configuration.
These events appear only in audit logs exported from your org's Settings page (not in audit logs exported for an individual workspace).
Member management
An org member added themselves to a workspace in the org.
Enterprise Owners can add themselves to any workspace as an admin. Other org members can add themselves to public workspaces only (they receive the Developer role).
An org member's role was changed.
This refers to a member's org-level role (such as Enterprise Owner), not their role within a particular workspace.
Two-factor authentication enforcement was enabled or disabled for the org.
Workspace management
The access setting for a workspace in the org was changed.
IdP management
A domain was added to the org as part of configuring SSO.
Ownership of a domain was verified as part of configuring SSO.
An SSO connection was created.
An SSO connection was changed.
An SSO connection was deleted.
A SCIM token was provisioned for the org.
A SCIM token was revoked for the org.
History of audit log event changes
| Date | Change |
|---|---|
|
|
Added initial set of Enterprise events. |
|
|
Added the following workspace event types: |
|
|
Added the following workspace event types: |
|
|
Added the following workspace event types: |
|
|
Added the following workspace event types:
|
|
|
Added initial set of Workspace events. |