System Audit Log
System audit logs record administrative actions taken inside the ALTR platform: creating a policy, adding an administrator, connecting a data source, changing a user group, and other configuration changes. Each entry captures who performed the action, when it happened, and which authentication method was used to make the request. System audit logs are distinct from Database Activity Monitoring, which records query-level activity in your connected databases rather than administrative actions inside ALTR.
Event Categories
Section titled “Event Categories”System audit logs are grouped into categories, each covering one kind of administrative action.
| Category | What it logs |
|---|---|
| Access Management Policy | Creating, deleting, and updating access management policies |
| Access Requests | Creating, approving, denying, and canceling access requests, with identities and justifications |
| Access Tokens | Sidecar access token creation |
| Administrators | Creating, removing, and updating administrator users |
| Agent Config | Changes to agent task definitions |
| Alerts | Creating, updating, and deleting alert rules, and adding and deleting alert comments — the configuration lifecycle for database activity monitoring alerts; labeled DAM Alerting internally |
| Anomalies | Alert events triggered by access-rate or time-window rules — the audit trail for legacy policy alerting; labeled Alerts internally |
| API Keys | Creating, removing, and updating API keys |
| Applications | Creating, removing, and updating server connections |
| Audit Report | Scheduled audit report activity, for compliance tracing |
| Data | Connecting, disconnecting, and updating columns |
| Data Sources | Connecting, disconnecting, and updating data sources |
| Impersonation Policy | Creating, deleting, and updating impersonation policies |
| Integrations | Creating, updating, and deleting notification-integration configurations and their subscriptions; labeled Notification Integration internally |
| Locks (legacy) | Creating, removing, and updating column access locks — deprecated, replaced by Unified Access Policy |
| Repository Configuration | Creating and deleting repositories, sidecars, listeners, and bindings |
| Row Access Policy | Creating, deleting, and updating row access policies |
| Thresholds (legacy) | Creating, removing, and updating thresholds — deprecated, legacy name for alerts |
| Unified Access Policy | Creating, deleting, and updating access policies and rules |
| User Groups | Creating, removing, and updating user groups |
Event Structure
Section titled “Event Structure”Each system audit entry captures an event summary, a timestamp, the acting user’s ID and username, and, when the action was performed using an API key, that key.
Expanding an entry reveals its detail payload: a category-specific JSON object containing the before-and-after state of the change. The detail payload includes a userIdentity sub-object with the acting user’s username, role, authentication type, and API key, if used. When an action fails, the detail payload also includes error fields: a code and a message describing the failure.
System audit entries are delivered near real-time, batched and written within seconds of the action occurring. They’re fast enough for compliance review, not designed for real-time alerting.
Action Attribution
Section titled “Action Attribution”Each system audit entry records which authentication method was used for the request: a JWT or an API key. ALTR’s portal UI authenticates using a JWT. Actions performed with an API key are attributed to the administrator who created that key. If the key is used by a third-party integration — for example, in a CI/CD pipeline or a custom script — every action the integration takes appears in the audit trail as the creating administrator.
View System Audit Logs
Section titled “View System Audit Logs”To view system audit logs:
- Select Audit Logs > System Audit in the navigation menu.
- Click one of the system audit log tabs.
The default time window is 7 days, and Completion Before and Completion After dates are required. Each query is limited to a 7-day span between those dates and returns up to 100 results per page.
System audit logs can be exported to Amazon S3 for external ingestion. See Amazon S3 Integration.