Tools for working with audit logs

You can upload audit logs to a Yandex Object Storage bucket, Yandex Cloud Logging log group, or data stream in Yandex Data Streams.

Use Cloud Logging to view logs stored in a log group, and jq to search for events in logs stored in a bucket.

Cloud LoggingCloud Logging

Use Cloud Logging to work with logs uploaded to a log group.

You can filter logs using the filter expression language to analyze Yandex Cloud resource events.

To use Cloud Logging:

1. Read logs in the log group.
2. Filter the logs as needed.

jqjq

Use jq to work with logs uploaded to a bucket.

Buckets store logs as JSON files. This means you can analyze Yandex Cloud resource events by retrieving the events you need from the files using jq filters.

To use jq:

1. Install and set up s3fs or goofys to mount Object Storage buckets using FUSE.

2. Mount a bucket with audit logs to your file system using s3fs or goofys.

3. Install jq.

4. Run the command with the relevant jq filter.