#Introduction

The platform's auditing function provides time-ordered operation records related to users and system security. This helps you analyze specific issues and quickly resolve problems that occur in clusters, custom applications, and other areas.

Through auditing, you can track various changes in the Kubernetes cluster, including:

• What changes occurred in the cluster during a specific time period
• Who performed these changes (system components or users)
• Details of important change events (e.g., POD parameter updates)
• Event outcomes (success or failure)
• Operator location (internal or external to the cluster)
• User operation records (updates, deletions, management operations) and their results

#Prerequisites

• Your account must have platform management or platform auditing permissions.

• This feature relies on the logging service. Please ensure that the ACP Log Essentails , ACP Log Collector and ACP Log Storage plugins are installed within the platform beforehand.

#Procedure

1. In the left navigation bar, click Auditing.

2. Select the auditing scope from the tabs:

   • User Operations: View operation records of users who have logged in to the platform
   • System Operations: View system operation records (operators start with system:)

3. Configure query conditions to filter auditing events:

   Query Condition	Description
   Operator	Username or system account name of the operator (default: All)
   Actions	Type of operation (create, update, delete, manage, rollback, stop, etc., default: All)
   Clusters	Cluster containing the operated resource (default: All)
   Resource Type	Type of the operated resource (default: All)
   Resource Name	Name of the operated resource (supports fuzzy search)

4. Click Search.

#Search Results

The search results display the following information: