Audit Logs

The Tetra Data Platform (TDP) has an audit trail feature that automatically logs system and user actions. You can use this feature for the auditing of, and compliance with 21 CFR reporting.

Only Administrators can access audit trail records; however, they cannot be altered. As an Administrator, you can access the audit trail page, filter and view audit trail records, and download them to a CSV for further analysis.

Audit trail records include:

  • User Actions (performed by users in the TDP software).
  • System Actions (programmatically performed in the TDP software).

๐Ÿ“˜

AWS and Auditing Information

  • Tetra Agent audit information displays in AWS CloudWatch.
  • AWS Infrastructure logs that contain automated and user-initiated data is captured in AWS CloudWatch and CloudTrail. For details about these features, see click these AWS documentation links: CloudWatch and CloudTrail.

For details on what is specifically audited, see this section of this topic.

Access the Audit Trail Page

Only Administrators can access the Audit Trail page. To access the page:

  1. Click the profile icon.
554554

Profile icon

  1. Click Account.
279279

Account selection

  1. Click Audit Trail from the menu on the left side of the page.
231231

Audit Trail selection

  1. The Audit Trail page displays the audit log records listing the most recent records at the top of the page:
14081408

Audit Trail page

View Audit Trail Records

To view audit trail records:

  1. From the Audit Trail page, you can filter the records by selecting options at the top of the page. To view all of the options, leave all of the filtered fields blank.

Audit Trail Filters

FieldDescription
Name (User or Entity)The name of the user or entity who/that initiated the action. The name can be a service account's name or an individual user's name.

For example, to see all of the authorization tokens that a specific user created, select User Name from the drop-down, and then enter the user name in the Name field.
From/To DateSelect the start (From) and end (To) date range from the calendar to view audit logs that were generated on or between those specific dates.

The To Date is exclusive; for example, if you select From Feb 7 To Feb 8, only data from Feb 7 displays.

To view the audit logs for all dates, leave these fields blank.
EntityIndicates what the action was performed on. For example, you could select Pipeline to view the logs related to pipelines. To view the available entities and their corresponding actions, see the Entities and Logged Actions table.
ActionIndicates what was action was performed on the entity. This field displays different information based on the selected entity. For example, if you select Pipeline as the entity, you could select to view all pipelines that were created, updated, deleted, or reprocessed.

To view the available entities and their corresponding actions, see the Entities and Logged Actions table.

Entities and Logged Actions

EntityActions
AgentCreate, Update, Delete, Enable, Disable, Enable Queue, Disable Queue, Change Cloud Configuration, Change Local Configuration, Start Agent, Stop Agent
Auth TokenCreate, Copy
Database CredentialsCreate, Delete
DatahubActivate, Create, Update, Enable, Disable, Delete, Sync, Update Config
Datahub AgentCreate, Update, Delete, Enable, Disable
Datahub ConnectorCreate, Update, Delete, Enable, Disable
FileUpload, Update Labels, Update Tags, Update Metadata, Update Metadata and Tags, Delete
Filter FieldCreate, Delete
IntegrationCreate, Update, Delete
SourceCreate, Update, Delete, Enable, Disable, Enable Queue, Disable Queue
IoT IntegrationCreate, Update, Delete
IoT SourceCreate, Update, Delete
LabelCreate, Delete
MetadataCreate, Delete
OrganizationCreate, Update, Delete
PipelineCreate, Update, Delete, Reprocess, Submit files for process
Service UserCreate, Update, Delete, Enable, Disable, Unlock, Change Role
Shared SecretCreate, Update, Delete
Shared SettingCreate, Update, Delete
UserCreate, Update, Delete, Enable, Disable, Unlock, Change Role, Change Password, Login Attempt
User SettingCreate, Update, Delete
TagCreate, Delete
WorkflowRestart
GIT IntegrationCreate, Update, Delete
Task Script ProfileCreate, Update
Task Script BuildCreate, Update, Delete
Feature FlagCreate, Update, Delete
  1. After you adjusted the filters, the updated results display in the Audit Trail page:
14081408

User Action Audit Trail

Audit Trail Result Fields

FieldDescription
EntityName of the entity the action was performed on. The entity contains three lines of information:
- First line: Brief one line summary of the entity, such as the specific pipeline's name or the specific label's title.
- Second line: ID number of the specific entity.
- Third line: Click the View Object link to view the specific entity in the Tetra Data Platform. For a pipeline example, it would show the pipeline in the Edit Pipeline page.
Entity TypeLists the entity type: Agent, Auth Token), Database Credentials, Datahub, Datahub Agent, Datahub Connector, File, Filter Field, Integration, Source, IoT Integration, IoT Source, Label, Metadata, Organization, Pipeline, Service User, Shared Secret, Shared Setting, User, User Setting, Tag, Workflow, GIT Integration, Task Script Profile, Task Script Build, Feature Flag
ActionThis menu indicates the action performed by the Entity/Type. To view the available entities and their corresponding actions, see the Entities and Logged Actions table.

The action contains two lines of information:
- First line: Lists the type of action. For a full list of actions and how they relate to entity types, see the Entities and Logged Actions table.
- Second line: Click the View Change link review the code change.
UserUser who initiated the action. The user can be a service account's name or an individual user's name.

The user contains three lines of information:
- Name of the user
- Type of user
- IP address
DateDate and time of the audit log entry.
  1. To review the next page of results, click the page number or arrow keys at the bottom right corner of the page.

Export Audit Trail History

To export your audit trail history to a CSV file:

  1. In the Audit Trail page, click one or more checkboxes for the audit logs you want to export. To select and export all of the records retrieved, click the checkbox next to the ENTITY column label.
374374

Audit Trail checkbox

  1. After you have selected one or more checkboxes, the Export xxx Selections to CSV button displays. Click the button to start the download process for the selected entities.
  2. The CSV file is downloaded and is ready to use. The CSV file provides additional information that is not shown in the audit trail results list:
  • id - Unique identifier of the specific entities in the log files.
  • org_slug - Organizational slug of the actor
  • actor_id - Unique identifier for the actors
  • actor_type - Indicates the type of actor
  • actor_name - Name of the actor
  • actor_email - Email address of the actor
  • ip_address - Actor's IP address
  • host - Name of the host
  • auth_token_ending - Last seven characters of the authorization token
  • entity_name - Name of entity
  • entity_type - Type of entity
  • entity_id - ID for the entity
  • action - Action performed on the entity
  • before - Entity details before the action was taken. Typically, for create or login-attempt actions, this field remains empty. For update or delete actions, the field shows the state of the entity before the action occurred.
  • after - Entity details after the action was taken. For delete actions, this field typically is empty.
  • entity-schema-version - Schema version for the entity (if the entity has one)
  • created_at - Date/timestamp for the log entry

View Historical Audit Trail Data From Previous Tetra Data Platform Versions

To view the audit trail data for historical audit trail data prior to upgrade to version 3.0 of the TDP:

  1. Click the Historical Audit Trail Data link in the upper right corner of the page.
12731273

Historical Audit Data link

  1. The Historical Audit Data page displays:
12021202

Historical Audit Data

  1. You can adjust these filters to view the logs:
  • From date/time - Display log entries starting with this date and time.
  • To date/time - Display log entries through this date and time.
  • Apply Date/Time Filters - Click to apply the date/time filters.
  • Entity - Select the entity to view.
  1. To adjust the number of logs shown per page, you can select a number in the Logs per Page drop-down at the bottom of the page. You can also select to view a range of logs from 20 to all log entries.
  2. To export your results as a CSV file, click Export as CSV near the top right corner of the page. You can specify these fields to export:
  • From date - Enter from the date, or click the calendar to select the date
  • From time - Enter from the time, or click the clock to select the time.
  • To date - Enter from the date, or click the calendar to select the date
  • To time - Enter from the time, or click the clock to select the time.
  • Entity - Select all or a specific entity to export.
  1. Click Export.
  2. To view the current audit trail data again, click the Current Audit Data link.