> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/sources/bindplane-audit-logs.md).

# Bindplane Audit Logs

The Bindplane Audit Logs source collects audit logs from a single Bindplane instance. Audit logs record user authentication, resource operations, configuration management, rollout behavior, and other system activity. The collector polls Bindplane on a fixed interval and converts each audit record into an OpenTelemetry log. Each source instance collects audit logs for one project. For a classic API key this would be the project it belongs to. For scoped API keys this is configured by setting the `Project ID`.

### Supported Telemetry Types

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Linux    |         | ✓    |        |
| Windows  |         | ✓    |        |
| macOS    |         | ✓    |        |

### Prerequisites

You need a reachable Bindplane instance and an API key for the project whose audit logs you want to collect.

* **API key.**
  * **(Recommended)** A scoped API key with the `Bindplane Telemetry` read permission for the target project. Set `Project ID` to that project's ID. See [Scoped API Keys](https://docs.bindplane.com/cli-and-api/scoped-api-keys).
  * A classic API key, created from the Project Settings page by a user with admin privileges. Audit logs are limited to the key's project. See [API Keys](https://docs.bindplane.com/cli-and-api/api-keys).
* **Cloud.** For a Bindplane Cloud instance, no host details are required. The source connects to `https://app.bindplane.com`.
* **Self-Hosted.** For a self-hosted instance, the collector must be able to reach the Bindplane host URL and port (default port `3001`). If the instance terminates TLS, provide the appropriate TLS settings under the Configuration section.

### Configuration

<figure><img src="https://1405008107-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgmiOMzBfoNFwmKJFHMcJ%2Fuploads%2FmIywXaUghX3cSIYVyxsI%2Fimage.png?alt=media&amp;token=dc475b31-637e-4a97-950f-a99af6915714" alt=""><figcaption></figcaption></figure>

**Logs**

| Parameter             | Type                     | Required                         | Default   | Description                                                                                                                                                                             |
| --------------------- | ------------------------ | -------------------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Host Type             | Enum: Cloud, Self-Hosted | No                               | Cloud     | Whether to connect to a Bindplane Cloud instance or a Self-Hosted instance.                                                                                                             |
| Bindplane API Key     | String                   | Yes                              | *(empty)* | A classic API key, or a scoped API key with the `Bindplane Telemetry` read permission. Stored as a sensitive value.                                                                     |
| Project ID            | String                   | Only when using a scoped API key | *(empty)* | The ID of the project to collect audit logs from. Pick one of your projects or enter any project ID. Required when using a scoped API key. Sent as the `X-Bindplane-Account-ID` header. |
| Bindplane Host Scheme | Enum: https, http        | No                               | https     | The protocol scheme used to reach the instance. Shown when Host Type is Self-Hosted.                                                                                                    |
| Bindplane Host URL    | String                   | Yes                              | *(empty)* | The host URL of the Bindplane instance to collect audit logs from. Shown when Host Type is Self-Hosted.                                                                                 |
| Bindplane Host Port   | String                   | No                               | 3001      | The port of the Bindplane instance to collect audit logs from. Shown when Host Type is Self-Hosted.                                                                                     |

**TLS (Self-Hosted)**

These parameters apply when Host Type is Self-Hosted.

| Parameter                         | Type    | Required | Default   | Description                                                                                                                                 |
| --------------------------------- | ------- | -------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable TLS                        | Boolean | No       | true      | Configure advanced TLS settings for the connection to the instance.                                                                         |
| Skip TLS Certificate Verification | Boolean | No       | false     | Skip TLS certificate verification. Shown when Enable TLS is true.                                                                           |
| TLS Certificate Authority File    | String  | No       | *(empty)* | Certificate authority used to validate TLS certificates. Shown when Enable TLS is true and certificate verification is not skipped.         |
| Server Name Override              | String  | No       | *(empty)* | Optional virtual hostname indicating the name of the server requested by the client. Generally not required. Shown when Enable TLS is true. |
| Mutual TLS                        | Boolean | No       | false     | Use mutual TLS authentication. Shown when Enable TLS is true.                                                                               |
| TLS Client Certificate File       | String  | No       | *(empty)* | A TLS certificate used for client authentication. Shown when Enable TLS and Mutual TLS are true.                                            |
| TLS Client Private Key File       | String  | No       | *(empty)* | A TLS private key used for client authentication. Shown when Enable TLS and Mutual TLS are true.                                            |

**Advanced**

| Parameter        | Type     | Required | Default | Description                                                                                                                                                                                 |
| ---------------- | -------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Poll Interval    | Duration | No       | 10s     | The interval to poll Bindplane for audit logs. Must be at least 10 seconds.                                                                                                                 |
| Parse Attributes | Boolean  | No       | false   | Parse audit log fields into individual log record attributes. When false, the body is the raw log message. Requires a collector with the `bindplaneauditlogs` receiver at v1.92.0 or later. |

### Examples

#### Collect audit logs from a Bindplane Cloud instance

This is the minimal configuration. It connects to `https://app.bindplane.com` and polls every 10 seconds using the provided API key.

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Cloud
    - name: bindplane_api_key
      value: <your-scoped-api-key>
    - name: bindplane_project_id
      value: <your-project-id>
```

#### Collect audit logs from a Self-Hosted instance over TLS

Reaches a self-hosted instance at `https://bindplane.internal:3001`, validates the server certificate with a CA file, and parses audit fields into attributes.

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Self-Hosted
    - name: bindplane_api_key
      value: <your-scoped-api-key>
    - name: bindplane_project_id
      value: <your-project-id>
    - name: bindplane_host_scheme
      value: https
    - name: bindplane_host_url
      value: bindplane.internal
    - name: bindplane_host_port
      value: "3001"
    - name: enable_tls
      value: true
    - name: ca_file
      value: /opt/tls/ca.crt
    - name: parse_attributes
      value: true
```

### Configuration Tips

* A classic API key determines which project's audit logs are collected. With a scoped API key, Project ID does. To collect audit logs from multiple projects, add one source instance per project.
* Set Poll Interval no lower than `10s`. Values below the minimum are rejected.
* Leave Parse Attributes off if you prefer to parse the raw body downstream, or turn it on to get structured attributes directly from the receiver. It requires a collector with the receiver at v1.92.0 or later.

### Troubleshooting

#### No audit logs are collected

Symptoms: the source connects but no log records arrive.

Solutions:

1. Confirm the API key is valid and unexpired. A classic key must belong to an admin user in the target project.
2. For a scoped API key, confirm Project ID is set and the key has the Bindplane Telemetry read permission for that project.
3. Confirm audit activity has occurred in the project since the source started.

#### Authentication or connection errors (Self-Hosted)

Symptoms: the collector reports connection refused, timeout, or TLS handshake errors.

Solutions:

1. Verify the Host URL, Host Scheme, and Host Port match the instance. The default port is `3001`.
2. If the instance uses a private or self-signed certificate, supply the CA file, or enable Skip TLS Certificate Verification for testing only.

#### Parse Attributes has no effect

Symptoms: the log body remains the raw message even though Parse Attributes is enabled.

Solutions:

1. Confirm the collector includes the `bindplaneauditlogs` receiver at v1.92.0 or later. Earlier versions ignore this option.

### Standalone Source

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Self-Hosted
    - name: bindplane_api_key
      value: <your-scoped-api-key>
    - name: bindplane_project_id
      value: <your-project-id>
    - name: bindplane_host_scheme
      value: https
    - name: bindplane_host_url
      value: bindplane.internal
    - name: bindplane_host_port
      value: "3001"
    - name: enable_tls
      value: true
    - name: insecure_skip_verify
      value: false
    - name: ca_file
      value: /opt/tls/ca.crt
    - name: poll_interval
      value: 10s
    - name: parse_attributes
      value: false
```

### Related Resources

* [Bindplane Audit Logs receiver](https://github.com/observIQ/bindplane-otel-collector/tree/main/receiver/bindplaneauditlogs)
* [API Keys](https://docs.bindplane.com/cli-and-api/api-keys)
* [Scoped API Keys](https://docs.bindplane.com/cli-and-api/scoped-api-keys)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.bindplane.com/integrations/sources/bindplane-audit-logs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.