11---
22title : " Audit"
3- description :
4- Learn how Coder audits user and admin actions for greater traceability.
3+ description : Learn how Coder audits user and admin actions.
54---
65
76Coder maintains records of all user actions on system resources for auditing
@@ -24,3 +23,34 @@ You can filter the logs displayed using the search filters available at the top:
2423- ** Resource Target** : The friendly name for the resource (e.g., the user with
2524 the email address ** dev@coder.com ** )
2625- ** User** : The user who performs the action
26+
27+ ## Actions
28+
29+ The audit logs capture information about the following actions (those who
30+ [ export Coder logs] ( ../guides/admin/logging.md ) will see this information under
31+ ` message.fields.audit_log.action ` ):
32+
33+ When reviewing Coder's audit logs, specifically, you will see the following
34+ actions included:
35+
36+ - ` auto_off ` : Coder automatically turned off a workspace due to inactivity
37+ - ` auto_start ` : Coder automatically turned on a workspace at the time preset by
38+ its owner
39+ - ` connect ` : a user connected to an existing workspace
40+ - ` cordon ` : a workspace provider became unavailable for new workspace creation
41+ requests.
42+ - ` create ` : the user created a Coder entity (e.g., dev URL, image/image tag,
43+ workspace, etc.)
44+ - ` delete ` : a user deleted a Coder entity (e.g., workspace or image)
45+ - ` enqueue ` : a user added a new job to the queue (e.g., workspace build, user
46+ deletion, workspace deletion)
47+ - ` login ` : a user logs in via basic authentication or OIDC, with Coder
48+ exchanging a token as a result
49+ - ` open ` : a user opened a workspace using an IDE through the browser
50+ - ` ssh ` : a user opened a web terminal or used SSH to access Coder
51+ - ` stop ` : a user manually stopped a workspace
52+ - ` uncordon ` : a workspace provider became available for new workspace creation
53+ requests.
54+ - ` view ` : the Coder CLI used a secret
55+ - ` write ` : the user made a change to a Coder entity (e.g., workspace, user,
56+ resource pool, etc.)
0 commit comments