Audit log

The Audit log provides a detailed view of all actions and events that occur within your clusters managed by Cast AI. This feature helps you track changes, troubleshoot issues, and maintain security compliance by recording both user-initiated actions and automated policy-driven changes.

Audit logs are available at two scopes:

• Cluster audit log: records actions and events for a single cluster across domains such as the Node Autoscaler and Workload Autoscaler, for example nodes being added or removed, autoscaler policy actions, workload optimization recommendation changes, and hibernation events.
• Organization audit log (early access): a timeline of events across your whole organization, covering clusters, nodes, commitments, and configuration changes.

This page covers both.

Accessing the cluster audit log

To view the audit log for a specific cluster:

1. In the Cast AI console, open Automation
2. Select your cluster
3. In the left menu under Cluster, select Logs

Accessing the organization's Activity log

To view events across all clusters in your organization:

1. Open the product menu at the top left of the Cast AI console
2. Select Activity log

While in early access, the page itself is labeled Event log. The Activity log lists events from every cluster and product area in a single timeline. You can filter it by domain (for example, Autoscaler), resource type, action, and severity, which makes it the right place to answer organization-level questions, such as when a cluster was connected or when automation was enabled.

The same 90-day retention policy applies to both cluster and organization audit logs.

Understanding the cluster audit log interface

The cluster audit log displays information in a table format with the following columns:

• Timestamp: When the action occurred
• Domain: The product area the event belongs to (for example, Workload Autoscaler or Node Autoscaler)
• Resource: The resource the event relates to and its type (for example, a workload under Recommended Requests, or a node)
• Action: What happened to the resource (for example, Updated, Executed, or Deleted)
• Actor: The user, service account, or policy that triggered the action
• Summary: A short description of the change

Each log entry can be expanded to view additional details about the event in a dedicated drawer:

The entry summary can then be viewed as is in this table format, or you can switch to the YAML/JSON view by clicking the {} icon in the top right of the opened drawer:

Filtering capabilities

The cluster audit log provides filtering options to help you find specific events. You can combine a keyword search and a time range with the filter groups in the left panel, and select several values across groups to narrow down results.

Search and time range

• Text search: Enter keywords in the search bar above the log entries to search event text
• Time range: Use the time-range selector in the top right to choose a preset (for example, Last 30 days) or specify a custom period

Filter groups

The filters panel on the left groups available filters, each showing how many matching events a value has:

• Severity: Filter by event severity, such as Info, Warn, or Error
• Domain: Filter by the product area the event belongs to, such as Workload Autoscaler or Node Autoscaler
• Resource type: Filter by the kind of resource involved, such as Recommended Requests, Surge, Node, Autoscaling, or CPU Pressure. Select Show more to see the full list.
• Action: Filter by what happened to the resource, such as Updated, Detected, Executed, Added, or Deleted

Select Show less to collapse an expanded group, or Clear at the top of the filters panel to reset all selected filters.

Types of tracked events

The cluster audit log tracks various events related to cluster operations, node management, and policy changes. Here's a complete list of events tracked by the system:

These events provide a comprehensive audit trail of all significant actions and changes within your cluster, enabling effective monitoring and troubleshooting of your Kubernetes environment.

Audit log retention and exporting

Audit logs are retained and accessible in the console for 90 days, after which they are archived (see Audit Log Retention Policy for details). However, if you need to analyze your audit logs externally or maintain them indefinitely, you can use our open-source Audit log exporter. This tool allows you to:

• Export audit logs to your preferred storage solution
• Perform custom analysis of historical data
• Maintain audit logs beyond the retention period
• Integrate audit data with your existing monitoring tools

To learn more about exporting your audit logs, visit our Audit log exporter documentation.