Introduction
Terraform Enterprise (TFE) emits audit logs together with its application logs. These audit log entries capture the username of the user that performed an operational action as the value for actor. There are two ways you can view these logs:
- By having Log Forwarding configured with your log indexing system of choice, then filtering for log entries that contain the string
[Audit Log]
- By viewing the logged events of the
ptfe_atlas
ortfe-atlas
container manually within your TFE server through SSH
Below are the steps to perform for viewing the audit logs manually within your TFE server through SSH:
Procedure
-
SSH into your TFE server
- Use the
grep
tool against the log entries of the TFE application container the audit logs are contained within to only output the audit log entries:docker logs tfe-atlas 2>&1 | grep '\[Audit Log\]'
- TFE installations that are version
v202204-1 and below
have the container named asptfe_atlas
- TFE installations that are version
v202205-1 and higher
have the container named astfe-atlas
- You will only be able to see the audit log events that have occurred since your TFE application last started. When the TFE application is restarted, the application containers are terminated, which causes the log associated to these containers to be wiped as well.
- TFE installations that are version
Example Scenario
Here's how to determine which user created a workspace:
- Through the TFE UI, go to Settings > General within the workspace in question to obtain that workspace's ID towards the top of that page
- Replace WORKSPACE_ID with the workspace's ID you obtained through the UI, then execute this command to view all the audit log events associated to the workspace:
docker logs tfe-atlas 2>&1 | grep '\[Audit Log\].*WORKSPACE_ID'
- the first logged event would be an Audit Log event of the workspace being created, that would show the user as the value for actor within the event
Here's an example audit log entry below where the user testuser1 is shown to have created the workspace:
2022-08-18 22:29:56 [INFO] [ef3d94c1-4720-4ce1-afe7-4bbe64baba65] [Audit Log] {"resource":"workspace","action":"create","resource_id":"ws-3pqtYbYCfbVJnCh3","organization":"test-company","organization_id":"org-71MgPitqbLXTxyz3","actor":"testuser1","timestamp":"2022-08-18T22:29:56Z","actor_ip":"11.111.111.11"}