Audit logs not showing KVM operations

[#1]

I am trying to access audit logs using audit log api. The main goal is to audit changes in KVM.

I am finding a few weird behaviors though -

- The response for all audit logs is only returning Proxy operations i,e deploy, delete, debugsessions etc. Are these only supported in Audit logging?

- I get response when I make call to all audit logs for an organizations. For all users or a particular user I just get an empty json back.

[sarthak]

Hi @jaskaran.rm I don't think KVM actions are stored in audit logs. Audit logs are designed to capture user actions and most of the times KVM actions are invoked from a policy and hence is not directly tied to a user.

Can you please clarify your 2nd point ?

Thanks

Sarthak

[#3]

Thanks. My second point was that among the different APIs listed in the audit log smartdocs page, only the one with the organization(see below) seems to be returning a response.

https://api.enterprise.apigee.com/v1/audits/organizations/{org_name}

[sarthak]

Hi @jaskaran.rm I ran some tests on my own org and I can see results for all the APIs.

Are you testing APIs listed here or here ? If you read the descriptions carefully you will see that the APIs do not return audit logs for what a user has done but rather if a particular user roles were updated. Hence most likely these APIs are returning no results for you.

If you try the other APIs they all will work.

Let me know if that helps.

Sarthak