Yandex Audit Trails event reference

Written by

Updated at July 29, 2026

Control plane event reference
Data plane event reference

Audit Trails supports tracking control plane and data plane events for Yandex Compute Cloud.

The general format of the event_type field value is as follows:

yandex.cloud.audit.compute.<event_name>

You can find the detailed JSON structure of the event record in the audit log reference. The events in it are sorted alphabetically without division into levels and contain all possible fields. In real logs, the field set depends on the parameters of the event and particular object.

Control plane event reference

Event name	Description
`AddInstanceOneToOneNat`	Adding a public IP address for a VM instance
`AttachInstanceDisk`	Connecting a disk to a VM
`AttachInstanceFilesystem`	Connecting a file system to a VM
`AttachInstanceNetworkInterface`	Connecting a network interface
`ChangeDiskStatus`	Changing a non-replicated disk status
`CrashInstance`	Emergency VM shutdown
`CreateDisk`	Creating a disk
`CreateDiskPlacementGroup`	Creating a disk placement group
`CreateFilesystem`	Creating a file system
`CreateGpuCluster`	Creating a GPU cluster
`CreateHostGroup`	Creating a group of dedicated hosts
`CreateImage`	Creating a disk image
`CreateInstance`	Creating a VM
`CreatePlacementGroup`	Creating a placement group
`CreateReservedInstancePool`	Creating a reserved instance pool
`CreateSnapshot`	Creating a disk snapshot
`CreateSnapshotSchedule`	Creating a disk snapshot schedule
`DecommissionHost`	Withdrawing a dedicated host for maintenance
`DeleteDisk`	Deleting a disk
`DeleteDiskPlacementGroup`	Deleting a disk placement group
`DeleteFilesystem`	Deleting a file system
`DeleteGpuCluster`	Deleting a GPU cluster
`DeleteHostGroup`	Deleting a group of dedicated hosts
`DeleteImage`	Deleting a disk image
`DeleteInstance`	Deleting a VM
`DeletePlacementGroup`	Deleting a placement group
`DeleteReservedInstancePool`	Deleting a reserved instance pool
`DeleteSnapshot`	Deleting a disk snapshot
`DeleteSnapshotSchedule`	Deleting a disk snapshot schedule
`DetachInstanceDisk`	Detaching a disk from a VM instance
`DetachInstanceFilesystem`	Detaching a file system from a VM instance
`DetachInstanceNetworkInterface`	Disconnecting a network interface
`DisableSnapshotSchedule`	Disabling a disk snapshot schedule
`EnableSnapshotSchedule`	Enabling a disk snapshot schedule
`GuestStopInstance`	Stopping a VM on command from this VM
`PreemptInstance`	Interrupting a VM
`RemoveInstanceOneToOneNat`	Removing a VM's public IP address
`RestartInstance`	Restarting a VM
`StartInstance`	Starting a VM
`StopInstance`	Stopping a VM
`UpdateDisk`	Changing a disk
`UpdateDiskPlacementGroup`	Updating a disk placement group
`UpdateFilesystem`	Modifying a file system
`UpdateGpuCluster`	Updating a GPU cluster
`UpdateHost`	Updating the automatic release date of a dedicated host
`UpdateHostGroup`	Updating a group of dedicated hosts
`UpdateImage`	Updating a disk image
`UpdateInstance`	Updating a VM instance
`UpdateInstanceMetadata`	Updating VM instance metadata
`UpdateInstanceNetworkInterface`	Updating VM network settings
`UpdatePlacementGroup`	Updating a placement group
`UpdateReservedInstancePool`	Updating a reserved instance pool
`UpdateSnapshot`	Updating a disk snapshot
`UpdateSnapshotSchedule`	Updating disk snapshot schedule parameters
`UpdateSnapshotScheduleDisks`	Updating disk snapshot schedule parameters
`instancegroup`	Managing an instance group
`instancegroup.CreateInstanceGroup`	Creating an instance group
`instancegroup.DeleteInstanceGroup`	Deleting an instance group
`instancegroup.DeleteInstanceGroupInstances`	Removing an instance from a group
`instancegroup.DisableZones`	Temporarily disabling availability zones
`instancegroup.EnableZones`	Enabling availability zones
`instancegroup.PauseInstanceGroup`	Pausing instance group management processes
`instancegroup.ResumeInstanceGroup`	Resuming instance group management processes
`instancegroup.RollingRecreateInstanceGroupInstances`	Recreating instances in group one by one
`instancegroup.RollingRestartInstanceGroupInstances`	Restarting instances in a group one by one
`instancegroup.SetInstanceGroupAccessBindings`	Assigning roles to an instance group
`instancegroup.StartInstanceGroup`	Starting an instance group
`instancegroup.StopInstanceGroup`	Stopping an instance group
`instancegroup.StopInstanceGroupInstances`	Stopping an instance from a group
`instancegroup.UpdateInstanceGroup`	Updating an instance group
`instancegroup.UpdateInstanceGroupAccessBindings`	Updating roles for an instance group

Data plane event reference

Event name	Description
`serialssh.ConnectSerialPort`	Connecting to an instance serial port
`MigrateInstance`	VM live migration ^*

* The audit log collects events only for VMs with a maintenance policy configured.

Yandex Audit Trails event reference

Control plane event referenceControl plane event reference

Data plane event referenceData plane event reference

Was the article helpful?

Control plane event reference

Data plane event reference