Searching Log Events

• Console
• CLI
• API

• 1. Open the navigation menu, click Identity & Security, and then click Audit

     The list of events that occurred in the current compartment is displayed.

  2. Under Compartment, select a compartment.

     Audit organizes logs by compartment, so if you are looking for a particular event, you must know which compartment the event occurred in.

  3. Click in the Start date box to choose the start date and time for the range of results you want to see. Click the arrows on either side of the month to go backward or forward.
  4. (Optional) Specify a time by doing one of the following: 
     1. Click Time and specify an exact start time in thirty-minute increments.
     2. Type an exact time in the Start date box.

        The service uses a 24-hour clock, so you must provide a number between 0 and 23 for the hour. Remember to calculate the offset between Greenwich Mean Time (GMT) and your local time.

  5. Repeat step 3 and 4 to choose an end date and time.
  6. (Optional) In the Keywords box, type the text you want to find and click Search.

     Tip: If you want to find log events with a specific status code, include quotes (") around the code to avoid results that have those numbers embedded in a longer string.

  7. (Optional) Under Request action types, specify one or more operations with which to filter results.
     • GET
     • POST 
     • PUT
     • PATCH
     • DELETE

  The results are updated to include only log events that were processed within the time range and filters you specified. If an event occurred in the recent past, you might have to wait to see it in the list. The service typically requires up to 15 minutes for processing.

  If the specified time range has more than 100 results for the specified time range, you can click the right arrow next to the page number at the bottom of the page to advance to the next page of log events.

  Tip
  
  If you get fewer than 100 results on the last page of a results list, you might still have more results, which you can access by clicking the right arrow. If there are more results, Audit prompts you to move forward.

  If you want to view all the key-value pairs in a log event, see Viewing the Details of a Log Event.

• This task can't be performed using the CLI.

• For information about using the API and signing requests, see REST API documentation and Security Credentials. For information about SDKs, see SDKs and the CLI.

  Use the following operation to list audit log events:

  ListEvents

  Note
  
  This API is not intended for bulk-export operations. For bulk export, see Bulk Export of Audit Log Events.