Audit log
Relic audits:
- changes to administration settings (users, groups, permissions, repositories, project members, LDAP, replication, cleanup policies, holds, security policies, watches, ignore rules, trusted keys, the trash can), through the Relic API or the Artifactory® API;
- UI sign-ins and CLI sign-in approvals;
- access tokens created and revoked;
- downloads a security policy blocked;
- SBOM imports (
sbom.import).
Each event names its time, actor, action (API method or route), target, client address and
outcome: Succeeded, Denied or Failed. Reads and artifact deploys are not audited.
Requests without credentials have the actor anonymous, a name no user can take.
Creating and revoking a token both name the token's ID; SCIM changes name the user or group.
Reading the log
Administrators and viewers read the log in Administration → Audit log, filtered by user, action, target, outcome and period.
List the last day's events:
relic audit list --since 24h
List one user's refused attempts:
relic audit list --actor bob --outcome denied
The Relic API method is AuditService.ListAuditEvents (GET /api/v1/audit-events).
Retention and export
The worker deletes events older than RELIC_AUDIT_RETENTION (365 days) daily.
Relic also logs each event as a relic.audit line. With log export on
(Monitoring), the OpenTelemetry collector forwards them to your
SIEM.