Skip to content

Auditing#

RStudio Connect records information about changes to the system. These events can be obtained for auditing purposes. Audited information is available in the RStudio Connect dashboard, by using the auditing endpoints in the Connect Server API, using the usermanager administrative command, or through an optional log file.

Note

The auditing system cannot be disabled and always records changes to the RStudio Connect database (even when an optional log file is configured). Database audit entries are maintained indefinitely.

Audited Events#

Recorded events in Connect can be triggered by a user or by the system. Each event may have different data associated. A complete list with all the details can be seen at the events catalog page.

Audit Log File#

Warning

This section describes a deprecated logging implementation which will be removed entirely with RStudio Connect's November 2022 edition. See the logging documentation for additional details.

Audited events can be optionally written to a file.

The Server.AuditLogFormat configuration setting controls whether or not auditing records are written to disk. By default, Server.AuditLogFormat has the value none, which indicates that auditing information is not written to disk.

Setting Server.AuditLogFormat to CSV or JSON will write to the file named by the Server.AuditLog option.

By default, Server.AuditLog writes to /var/log/rstudio-connect.audit.log. The Server.AuditLog file is created only when the Server.AuditLogFormat permits on-disk logging.

Note

Audit log files contain actions performed through a specific RStudio Connect server. In a clustered installation, the auditing files from each server need to be combined.

The Connect dashboard, Server API, and usermanager tool present all auditing information, not per-server records.

This configuration example enables CSV audit logging and is using the default audit log location.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Server]
AuditLogFormat = "CSV"

This configuration example enables JSON audit logging and writes to a different file name.

; /etc/rstudio-connect/rstudio-connect.gcfg
[Server]
AuditLogFormat = "JSON"
AuditLog = "/var/log/rstudio-connect.audit.json"

Warning

RStudio Connect will refuse to start if the Server.AuditLog file already exists and has content that appears to contradict the format requested by Server.AuditLogFormat. In other words, if the file looks like it is in CSV format but the configuration requests JSON or looks like JSON and the configuration requests CSV, the server will not start.

CSV format#

The CSV audit log format has fields written in the following order:

  • The database ID of the audit log record.

  • The timestamp of the record, in RFC 3339.

  • The database ID of the user that performed the action.

  • The description of the user.

  • The action the user performed.

  • The description of the event.

JSON format#

When formatting entries in JSON, each text line written to the audit log file will be a single, complete JSON object with the same data as for CSV with field names, id, time, user_id, user_description, action and event_description, respectively.

The specification of the JSON object is the one used for Audit Logs in the Connect Server API.

Command-Line Interface#

The usermanager administration command-line tool can produce CSV and JSON containing auditing records, and can also filter by time interval. See the Command-Line interface appendix for more information about the usermanager tool.

Copyright © RStudio, PBC. All Rights Reserved