Platform:
Audit Events
Alert category
Events relating to alerts.
Alert/Create operation
An alert is created.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Alert/Update operation
An alert is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Alert/Remove operation
An alert is removed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Alert/Disable operation
An alert is administratively disabled.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
ApiKey category
Events relating to API keys.
ApiKey/Create operation
An API key is created.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
ApiKey/Update operation
An API key is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
ApiKey/Remove operation
An API key is removed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App category
Events relating to hosted Seq apps.
App/Install operation
An app package is installed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/UpdatePackage operation
An app package is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Uninstall operation
An app package is uninstalled.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Start operation
An app instance is created and started.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/UpdateInstance operation
An app instance is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Stop operation
An app instance is stopped and removed
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
App/Invoke operation
An event is manually sent to a running app instance.
A Record event will be durably stored before the operation is allowed to proceed.
Availability category
Events relating to system availability.
Availability/TakeOffline operation
A request is made to take the current leader node offline.
A Record event will be durably stored before the operation is allowed to proceed.
Backup category
Events relating to Seq metadata backups.
Backup/Download operation
A request to download an existing system backup.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Backup/CreateImmediate operation
A request to create and download a new system backup.
A Record event will be durably stored before the operation is allowed to proceed.
Dashboard category
Events relating to dashboards.
Dashboard/Create operation
A dashboard is created.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Dashboard/Update operation
A dashboard is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Dashboard/Remove operation
A dashboard is removed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Data category
Events relating to stored log event data.
Data/Search operation
A search within the event stream.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/Query operation
A SQL-style query over the event stream.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/Export operation
An event export.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/ReadSingle operation
A request to retrieve a single event.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Data/ManualDelete operation
A manual deletion of events in the event stream.
A Record event will be durably stored before the operation is allowed to proceed.
Diagnostics category
Events relating to Seq's inbuilt diagnostics.
Diagnostics/ProduceIngestionLog operation
A request to download or view the ingestion log.
A Record event will be durably stored before the operation is allowed to proceed.
Diagnostics/ProduceDiagnosticReport operation
A request to download the full system diagnostic report.
A Record event will be durably stored before the operation is allowed to proceed.
Feed category
Events relating to app (NuGet) package feeds.
Feed/Create operation
A package feed is created.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Feed/Update operation
A package feed is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Feed/Remove operation
A package feed is removed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Integrity category
Events relating to security-relevant system integrity.
Integrity/ApiMisuse operation
An attempt to use the Seq HTTP API in a manner that would compromise system integrity.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Integrity/PermissionDenied operation
An attempt to perform actions that are forbidden by access control policy. Note that this does not include rejection of unauthenticated requests (these events are associated with an authenticated principal).
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
Integrity/InternalServerError operation
An HTTP API request caused Seq to fail in an unexpected manner.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
RetentionPolicy category
Events relating to retention policies.
RetentionPolicy/Create operation
A retention policy is created.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
RetentionPolicy/Update operation
A retention policy is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
RetentionPolicy/Remove operation
A retention policy is removed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Setting category
Events relating to runtime-modifiable system settings.
Setting/Update operation
A system setting is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Setting/TelemetryUpdate operation
Telemetry settings were updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Signal category
Events relating to Seq signals.
Signal/Create operation
A signal is created.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Signal/Update operation
A signal is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
Signal/Remove operation
A signal is removed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User category
Events relating to Seq users.
User/Create operation
A user is created.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/Update operation
A user is updated.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/Remove operation
A user is removed.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/LocalLogin operation
Establishment of a local Seq user session (either username/password or Active Directory authentication).
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/LocalLogout operation
Local user session logged out.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/OidcTokenValidated operation
A login token from a remote authentication provider was successfully validated.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/OidcUserInformationReceived operation
User information was received from the remote authentication provider.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/RemoteSignIn operation
An identity from a remote authentication provider is signed in. This does not always indicate that an existing Seq user account matches the identity.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/AutomaticLinkUser operation
A local user is linked to an identity from a remote provider by matching identity information.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/AutomaticUpdateUser operation
A local user is updated based on new information from a remote provider.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/RemoteSignOut operation
Requests to sign out from a remote authentication provider. This does not conclusively imply that a remote session is authenticated.
An Advise event may be recorded after completion of the operation and is not guaranteed to be present in the face of power outages and other disruptions.
User/PasswordChange operation
Local user password change attempts.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.
User/UnlinkAuthenticationProvider operation
Disassociation of a user account from an identity managed by a remote provider.
A Begin event will be durably stored before the operation is allowed to proceed. Following the operation a further Complete , Fail , or Abandon event will be stored to document the result of the operation, though this event may be lost in the presence of power outages and other disruptions.