Audit Events

Alert category

Events relating to alerts.

Alert/Create operation

An alert is created.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Alert/Update operation

An alert is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Alert/Remove operation

An alert is removed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Alert/Disable operation

An alert is administratively disabled.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

ApiKey category

Events relating to API keys.

ApiKey/Create operation

An API key is created.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

ApiKey/Update operation

An API key is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

ApiKey/Remove operation

An API key is removed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

App category

Events relating to hosted Seq apps.

App/Install operation

An app package is installed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

App/UpdatePackage operation

An app package is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

App/Uninstall operation

An app package is uninstalled.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

App/Start operation

An app instance is created and started.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

App/UpdateInstance operation

An app instance is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

App/Stop operation

An app instance is stopped and removed

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

App/Invoke operation

An event is manually sent to a running app instance.

A Record event will be durably stored before the operation is allowed to proceed.

Availability category

Events relating to system availability.

Availability/TakeOffline operation

A request is made to take the current leader node offline.

A Record event will be durably stored before the operation is allowed to proceed.

Backup category

Events relating to Seq metadata backups.

Backup/Download operation

A request to download an existing system backup.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Backup/CreateImmediate operation

A request to create and download a new system backup.

A Record event will be durably stored before the operation is allowed to proceed.

Dashboard category

Events relating to dashboards.

Dashboard/Create operation

A dashboard is created.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Dashboard/Update operation

A dashboard is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Dashboard/Remove operation

A dashboard is removed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Data category

Events relating to stored log event data.

Data/Search operation

A search within the event stream.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

Data/Query operation

A SQL-style query over the event stream.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

Data/Export operation

An event export.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

Data/ReadSingle operation

A request to retrieve a single event.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

Data/ManualDelete operation

A manual deletion of events in the event stream.

A Record event will be durably stored before the operation is allowed to proceed.

Diagnostics category

Events relating to Seq's inbuilt diagnostics.

Diagnostics/ProduceIngestionLog operation

A request to download or view the ingestion log.

A Record event will be durably stored before the operation is allowed to proceed.

Diagnostics/ProduceDiagnosticReport operation

A request to download the full system diagnostic report.

A Record event will be durably stored before the operation is allowed to proceed.

Feed category

Events relating to app (NuGet) package feeds.

Feed/Create operation

A package feed is created.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Feed/Update operation

A package feed is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Feed/Remove operation

A package feed is removed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Integrity category

Events relating to security-relevant system integrity.

Integrity/ApiMisuse operation

An attempt to use the Seq HTTP API in a manner that would compromise system integrity.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

Integrity/PermissionDenied operation

An attempt to perform actions that are forbidden by access control policy. Note that this does not include rejection of unauthenticated requests (these events are associated with an authenticated principal).

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

Integrity/InternalServerError operation

An HTTP API request caused Seq to fail in an unexpected manner.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

RetentionPolicy category

Events relating to retention policies.

RetentionPolicy/Create operation

A retention policy is created.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

RetentionPolicy/Update operation

A retention policy is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

RetentionPolicy/Remove operation

A retention policy is removed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Setting category

Events relating to runtime-modifiable system settings.

Setting/Update operation

A system setting is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Setting/TelemetryUpdate operation

Telemetry settings were updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Signal category

Events relating to Seq signals.

Signal/Create operation

A signal is created.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Signal/Update operation

A signal is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

Signal/Remove operation

A signal is removed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User category

Events relating to Seq users.

User/Create operation

A user is created.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/Update operation

A user is updated.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/Remove operation

A user is removed.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/LocalLogin operation

Establishment of a local Seq user session (either username/password or Active Directory authentication).

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/LocalLogout operation

Local user session logged out.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/OidcTokenValidated operation

A login token from a remote authentication provider was successfully validated.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

User/OidcUserInformationReceived operation

User information was received from the remote authentication provider.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

User/RemoteSignIn operation

An identity from a remote authentication provider is signed in. This does not always indicate that an existing Seq user account matches the identity.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

User/AutomaticLinkUser operation

A local user is linked to an identity from a remote provider by matching identity information.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/AutomaticUpdateUser operation

A local user is updated based on new information from a remote provider.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/RemoteSignOut operation

Requests to sign out from a remote authentication provider. This does not conclusively imply that a remote session is authenticated.

An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.

User/PasswordChange operation

Local user password change attempts.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.

User/UnlinkAuthenticationProvider operation

Disassociation of a user account from an identity managed by a remote provider.

A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.