--- title: "Generating OVHcloud account logs with Logs Data Platform" description: "Please refer to this documentation to learn more about Logs Data Platform before continuing with this guide." url: https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/generating-ovhcloud-account-logs lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # Generating OVHcloud account logs with Logs Data Platform Please refer to [this documentation](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/introduction-to-logs-data-platform.md) to learn more about Logs Data Platform before continuing with this guide.   ## Requirements - An [OVHcloud customer account](https://docs.us.ovhcloud.com/en/account/account-information/create-account.md) - A Logs Data Platform account within this OVHcloud account with at least one active stream configured ([this guide](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/getting-started.md) will walk you through all the necessary steps)   ## Glossary **Logs Data Platform (LDP)**: Fully managed and secured log management platform proposed by OVHcloud. Find more information on the [Logs Data Platform service page](https://us.ovhcloud.com/logs-data-platform/). **Data stream**: A logical partition of logs that you create in an LDP account that you will use when ingesting, visualizing, or querying your logs. Multiple sources can be stored in the same data stream, and it is the unit for defining a logs pipeline (retention policy, archiving, live streaming, etc.), access rights, and alert policies. **Logs forwarding**: Feature integrated into an OVHcloud product to ingest logs from its services to a data stream of an LDP account in the same OVHcloud account. The feature has to be enabled by the customer per service. **Logs forwarding subscription**: When enabling the logs forwarding for a given OVHcloud service to a given LDP data stream, a subscription is created and attached to the data stream for further management by the customer.   ## Instructions ### OVHcloud Account logs types OVHcloud account offers three levels of logs: - **Audit Logs**: Provide a security-relevant, chronological set of records documenting the sequence of actions in your OVHcloud account (i.e. logins, password change, etc.). - **Activity Logs**: Provide all records of actions in your OVHcloud account from API calls and actions done in the Control Panel. - **Access policy logs**: Provide all records of access evaluation in your OVHcloud account, including actions from third-party integration (i.e. actions authorized or unauthorized through IAM policies).   ### Enable logs forwarding You can enable the forwarding of the OVHcloud account logs via API. You will have to target a stream of one of your LDP accounts. The logs will be forwarded to that stream. Enabling the forwarding will create a subscription for this stream ID. Note that enabling the forwarding is free of charge, but you will be charged for the usage of your Logs Data Platform service as per the standard price plan. For LDP pricing refer to the [Logs Data Platform product page](https://us.ovhcloud.com/logs-data-platform/). #### Via OVHcloud Control Panel #### Logs direct access From the OVHcloud Control Panel, navigate to the `Account Logs` section via the `Identity, Security & Operations` menu. Once there, select the tab for the type of logs you want to subscribe to: `Audit logs`, `Activity logs`, or `Access policy logs`.   #### Logs access through LDP From the `Logs` tab, you can `Subscribe` to an LDP data stream. Once the subscription is enabled, all the logs will be pushed to [Logs Data Platform](https://us.ovhcloud.com/identity-security-operations/logs-data-platform/) to archive generated logs and perform advanced searches, and create alerts or visualizations. For more information, please refer to our [Quick Start for Logs Data Platform](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/getting-started.md) guide. ##### Via OVHcloud API To enable forwarding, you can use the following API call to forward API and Control Panel logs: - Audit logs: `POST /me/logs/audit/log/subscription` - Activity logs: `POST /me/api/log/subscription` - Access policy logs: `POST /iam/log/subscription` For example, for activity logs: ```json POST /me/api/log/subscription { "kind": "access" "streamId": "ab51887e-0b98-4752-a514-f2513523a5cd" } ``` The API requires: - A `streamId`, which is the target data stream of your LDP account where your OVHcloud account logs will be forwarded to. - A `kind`, which is the category of logs you want to forward into this data stream. You will get in response an `operationId`, so you can use it to retrieve the `subscriptionId` for further management purposes using the Logs Data Platform read operation endpoint: [GET /dbaas/logs/{serviceName}/operation](https://api.us.ovhcloud.com/console/?section=/dbaas/logs&branch=v1#get-/dbaas/logs/-serviceName-/operation) **Note:** You can find your `streamId` in the `Logs Data Platform` section of the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/). Go to the `Data streams` tab of your Logs Data Platform account. In the table, click the _more options_`...` button to the right of the target data stream, then click `Copy stream ID`. Alternatively, you can retrieve your streams using the Logs Data Platform API: [GET /dbaas/logs/{serviceName}/output/graylog/stream](https://api.us.ovhcloud.com/console/?section=/dbaas/logs&branch=v1#get-/dbaas/logs/-serviceName-/output/graylog/stream) [GET /dbaas/logs/{serviceName}/output/graylog/stream/{streamId}](https://api.us.ovhcloud.com/console/?section=/dbaas/logs&branch=v1#get-/dbaas/logs/-serviceName-/output/graylog/stream/-streamId-) You can find the available kind using the following APIs: - Audit logs kinds: `GET /me/logs/audit/log/kind` - Activity logs kinds: `GET /me/api/log/kind` - Access policy logs kinds: `GET /iam/log/kind`   ### Access to OVHcloud account logs Now that your OVHcloud account logs are ingested and stored in your Logs Data Platform data stream, you can query your logs and build dashboards to have a graphical representation using the web-based UI of Graylog. - Retrieve the admin user (the Logs Data Platform service name) and the password in your Logs Data Platform account `Home` tab. - Open the Graylog `web-ui`. You can retrieve the link from your account home page, or use your access point depending on your account region (for example, the Beauharnois region is [https://bhs2.logs.ovh.com/](https://bhs2.logs.ovh.com/)). - Log in to Graylog using your **Logs Data Platform service name** and **password**. - Search through your logs across the data stream of your Logs Data Platform account. You can refer to the [Graylog writing search queries documentation](https://go2docs.graylog.org/4-0/making_sense_of_your_log_data/writing_search_queries.html?tocpath=Searching%20Your%20Log%20Data%7C_____1) for details on the search syntax. For more details about how to use your logs with Logs Data Platform, refer to the documentation [Logs Data Platform - Visualizing, querying, and exploiting your logs](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/opensearch-dashboards.md). This includes: - How to set up alerts. - How to view the logs in real time through a WebSocket. - How to build visualization with OpenSearch Dashboards. - How to integrate with OpenSearch API. - How to to connect with Grafana.   ### Details of generated logs #### Audit logs For every action related to the security of the OVHcloud account, an entry is generated. The Logs generated are: **For login:** **Note:** The fields displayed depend on the type of log; you may not see all fields for every log you generate. | **Field** | **Value** | **Description** | | ------------------------------ | ------------------------- | ------------------------------------------------------------------------------------------------------------- | | account | String | OVHcloud account concerned by the action | | authDetails\_userDetails\_type | ACCOUNT, PROVIDER or USER | Indicate if the user is a root account (ACCOUNT), a local user (USER) or a user coming from an SSO (PROVIDER) | | authDetails\_userDetails\_user | String | Name of the user | | client\_ip | String | IP of the user who performed the action | | client\_ip\_geolocation | String | Geolocalisation of the user who performed the action | | client\_ip\_city\_name | String | City name of the user who performed the action (if available) | | client\_ip\_country\_code | String | Country code of the user who performed the action | | loginSuccessDetails\_mfaType | String | Indicate the type of MFA use: BACKUP\_COD, MAIL, NONE, SMS, TOTP, U2F, UNKNOWN | | loginSuccessDetails\_userAgent | String | User agent of the user | | source | String | iam.ovhcloud | | type | String | LOGIN\_SUCCESS |   **For password change:** **Note:** The fields displayed depend on the type of log; you may not see all fields for every log you generate. | **Field** | **Value** | **Description** | | -------------------------- | --------- | ------------------------------------------------------------- | | account | String | OVHcloud account concerned by the action | | client\_ip | String | IP of the user who performed the action | | client\_ip\_city\_name | String | City name of the user who performed the action (if available) | | client\_ip\_country\_code | String | Country code of the user who performed the action | | client\_ip\_geolocation | String | Geolocalization of the user who performed the action | | source | String | iam.ovhcloud | | type | String | ACCOUNT\_PASSWORD\_CHANGED, USER\_PASSWORD\_CHANGED | | userPasswordChangedDetails | String | Login of user impacted by password change |   #### Activity logs For every action performed by users through the API or the Control Panel, an entry is generated with the following data: **Note:** The fields displayed depend on the type of log; you may not see all fields for every log you generate. | **Field** | **Value** | **Description** | | ------------------------- | ------------------------ | ---------------------------------------------------------------------------------------- | | account | String | OVHcloud account concerned by the action | | client\_ip | String | IP of the user who performed the action | | client\_ip\_city\_name | String | City name of the user who performed the action (if available) | | client\_ip\_country\_code | String | Country code of the user who performed the action | | client\_ip\_geolocation | String | Geolocalization of the user who performed the action | | identities\_array | Array of String | List of identities of the user who performed the action (user URN and user’s groups URN) | | method | GET, POST, PUT or DELETE | Method of the API | | path | String | API call concerned by the action | | request\_id | String | Unique ID of the request | | service\_name | String | OVHcloud services concerned by the action | | source | manager or api | If the action was performed through the Control Panel (manager) or the API (api) | | status\_int | Number | HTTP code of request result | | url | String | URL called on the action | | user\_agent | String | User agent of the user who performed the action | | username | String | Username of the user who performed the action |   #### Access Policies logs For every action evaluated by the OVHcloud IAM, an entry is generated with the following data: **Note:** The fields displayed depend on the type of log; you may not see all fields for every log you generate. | **Field** | **Value** | **Description** | | ---------------------------- | --------------- | ---------------------------------------------------------------------------------------- | | account | String | OVHcloud account concerned by the action | | identities\_array | Array of String | List of identities of the user who performed the action (user URN and user’s groups URN) | | requested\_actions\_array | Array of String | List of actions requested by the user | | resource | String | URN of the OVHcloud resource concerned by the action | | authorized\_actions\_array | Array of String | List of actions authorized after policy evaluation | | unauthorized\_actions\_array | Array of String | List of actions unauthorized after policy evaluation |   ### Manage subscriptions At any point, you can retrieve subscriptions attached to your Logs Data Platform data stream and choose to disable the forwarding by cancelling your subscription on your stream. So that your Logs Data Platform stream doesn't receive your audit logs anymore. Note that this doesn't delete the logs that have been stored prior to the subscription cancellation, as data stored in a logs stream is immutable unless you delete the entire stream. #### Via OVHcloud Control Panel You can unsubscribe from your service logs in two ways: 1. From the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/), navigate to the `Account Logs` section via the `Identity, Security & Operations` menu. Once there, select the tab for the type of logs you want to unsubscribe from: `Audit logs`, `Activity logs`, or `Access policy logs`. Click `Unsubscribe`. 2. From the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/), navigate to the `Logs Data Platform` section via the `Identity, Security & Operations` menu. Once there, select your service and the `Data stream` tab. Click the _more options_ `...` button to the right of your stream and choose `Manage subscriptions`. Click the _trash_ `🗑️` icon to the right of any subscription you wish to delete. #### Via OVHcloud API The three following Logs Data Platform API routes respectively allow you to: - Retrieve a list of `subscriptionId`s associated with a specific logs stream based on its `streamId`. `GET /dbaas/logs/{serviceName}/output/graylog/stream/{streamId}/subscription` - Retrieve the information (such as the _resource type_, in this case **account-api**, **account-iam** and **account-audit**, and _resource name_ – the name of the OVHcloud account) of the service associated with the subscription based on its `subscriptionId`. `GET /dbaas/logs/{serviceName}/output/graylog/stream/{streamId}/subscription/{subscriptionId}` - Delete a subscription based on its `subscriptionId`. `DELETE /dbaas/logs/{serviceName}/output/graylog/stream/{streamId}/subscription/{subscriptionId}`   ## Go further Browse all the [Logs Data Platform guides](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/landing-page-logs-data-platform.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Logs Data Platform](https://us.ovhcloud.com/identity-security-operations/logs-data-platform/) on the OVHcloud US website.