Audit Events
Alert
category
Events relating to alerts.
Alert/Create
operation
An alert is created.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Alert/Update
operation
An alert is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Alert/Remove
operation
An alert is removed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Alert/Disable
operation
An alert is administratively disabled.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
ApiKey
category
Events relating to API keys.
ApiKey/Create
operation
An API key is created.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
ApiKey/Update
operation
An API key is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
ApiKey/Remove
operation
An API key is removed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App
category
Events relating to hosted Seq apps.
App/Install
operation
An app package is installed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/UpdatePackage
operation
An app package is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Uninstall
operation
An app package is uninstalled.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Start
operation
An app instance is created and started.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/UpdateInstance
operation
An app instance is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Stop
operation
An app instance is stopped and removed
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Invoke
operation
An event is manually sent to a running app instance.
A Record
event will be durably stored before the operation is allowed to proceed.
Availability
category
Events relating to system availability.
Availability/TakeOffline
operation
A request is made to take the current leader node offline.
A Record
event will be durably stored before the operation is allowed to proceed.
Backup
category
Events relating to Seq metadata backups.
Backup/Download
operation
A request to download an existing system backup.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Backup/CreateImmediate
operation
A request to create and download a new system backup.
A Record
event will be durably stored before the operation is allowed to proceed.
Dashboard
category
Events relating to dashboards.
Dashboard/Create
operation
A dashboard is created.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Dashboard/Update
operation
A dashboard is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Dashboard/Remove
operation
A dashboard is removed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Data
category
Events relating to stored log event data.
Data/Search
operation
A search within the event stream.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/Query
operation
A SQL-style query over the event stream.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/Export
operation
An event export.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/ReadSingle
operation
A request to retrieve a single event.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/ManualDelete
operation
A manual deletion of events in the event stream.
A Record
event will be durably stored before the operation is allowed to proceed.
Diagnostics
category
Events relating to Seq's inbuilt diagnostics.
Diagnostics/ProduceIngestionLog
operation
A request to download or view the ingestion log.
A Record
event will be durably stored before the operation is allowed to proceed.
Diagnostics/ProduceDiagnosticReport
operation
A request to download the full system diagnostic report.
A Record
event will be durably stored before the operation is allowed to proceed.
Feed
category
Events relating to app (NuGet) package feeds.
Feed/Create
operation
A package feed is created.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Feed/Update
operation
A package feed is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Feed/Remove
operation
A package feed is removed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Integrity
category
Events relating to security-relevant system integrity.
Integrity/ApiMisuse
operation
An attempt to use the Seq HTTP API in a manner that would compromise system integrity.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Integrity/PermissionDenied
operation
An attempt to perform actions that are forbidden by access control policy. Note that this does not include rejection of unauthenticated requests (these events are associated with an authenticated principal).
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Integrity/InternalServerError
operation
An HTTP API request caused Seq to fail in an unexpected manner.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
RetentionPolicy
category
Events relating to retention policies.
RetentionPolicy/Create
operation
A retention policy is created.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
RetentionPolicy/Update
operation
A retention policy is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
RetentionPolicy/Remove
operation
A retention policy is removed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Setting
category
Events relating to runtime-modifiable system settings.
Setting/Update
operation
A system setting is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Setting/TelemetryUpdate
operation
Telemetry settings were updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Signal
category
Events relating to Seq signals.
Signal/Create
operation
A signal is created.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Signal/Update
operation
A signal is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Signal/Remove
operation
A signal is removed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User
category
Events relating to Seq users.
User/Create
operation
A user is created.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/Update
operation
A user is updated.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/Remove
operation
A user is removed.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/LocalLogin
operation
Establishment of a local Seq user session (either username/password or Active Directory authentication).
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/LocalLogout
operation
Local user session logged out.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/OidcTokenValidated
operation
A login token from a remote authentication provider was successfully validated.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/OidcUserInformationReceived
operation
User information was received from the remote authentication provider.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/RemoteSignIn
operation
An identity from a remote authentication provider is signed in. This does not always indicate that an existing Seq user account matches the identity.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/AutomaticLinkUser
operation
A local user is linked to an identity from a remote provider by matching identity information.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/AutomaticUpdateUser
operation
A local user is updated based on new information from a remote provider.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/RemoteSignOut
operation
Requests to sign out from a remote authentication provider. This does not conclusively imply that a remote session is authenticated.
An Advise
event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/PasswordChange
operation
Local user password change attempts.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/UnlinkAuthenticationProvider
operation
Disassociation of a user account from an identity managed by a remote provider.
A Begin
event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete
, Fail
, or Abandon
event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.