> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/sources/bindplane-audit-logs.md).

# Bindplane Audit Logs

The Bindplane Audit Logs source collects audit logs from a single Bindplane instance. Audit logs record user authentication, resource operations, configuration management, rollout behavior, and other system activity. The collector polls Bindplane on a fixed interval and converts each audit record into an OpenTelemetry log. Audit logs are scoped to the project associated with the API key, so each source instance collects logs for one project.

### Supported Telemetry

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Linux    |         | ✓    |        |
| macOS    |         | ✓    |        |
| Windows  |         | ✓    |        |

### Prerequisites

You need a reachable Bindplane instance and an API key for the project whose audit logs you want to collect.

* **API key.** Create an API key from the Project Settings page in the Bindplane UI. The key must belong to a user with admin privileges, and audit logs are limited to the project the key is scoped to. See [API Keys](https://docs.bindplane.com/cli-and-api/api-keys).
* **Cloud.** For a Bindplane Cloud instance, no host details are required. The source connects to `https://app.bindplane.com`.
* **Self-Hosted.** For a self-hosted instance, the collector must be able to reach the Bindplane host URL and port (default port `3001`). If the instance terminates TLS, provide the appropriate TLS settings under the Configuration section.

### Configuration

<figure><img src="/files/ORrkO2xWHklptAKmJz2d" alt="Bindplane docs - Bindplane Audit Logs - image 1"><figcaption></figcaption></figure>

**Logs**

| Parameter             | Type                     | Required | Default   | Description                                                                                             |
| --------------------- | ------------------------ | -------- | --------- | ------------------------------------------------------------------------------------------------------- |
| Host Type             | Enum: Cloud, Self-Hosted | No       | Cloud     | Whether to connect to a Bindplane Cloud instance or a Self-Hosted instance.                             |
| Bindplane API Key     | String                   | Yes      | *(empty)* | The API key of the Bindplane instance to collect audit logs from. Stored as a sensitive value.          |
| Bindplane Host Scheme | Enum: https, http        | No       | https     | The protocol scheme used to reach the instance. Shown when Host Type is Self-Hosted.                    |
| Bindplane Host URL    | String                   | Yes      | *(empty)* | The host URL of the Bindplane instance to collect audit logs from. Shown when Host Type is Self-Hosted. |
| Bindplane Host Port   | String                   | No       | 3001      | The port of the Bindplane instance to collect audit logs from. Shown when Host Type is Self-Hosted.     |

**TLS (Self-Hosted)**

These parameters apply when Host Type is Self-Hosted.

| Parameter                         | Type    | Required | Default   | Description                                                                                                                                 |
| --------------------------------- | ------- | -------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable TLS                        | Boolean | No       | true      | Configure advanced TLS settings for the connection to the instance.                                                                         |
| Skip TLS Certificate Verification | Boolean | No       | false     | Skip TLS certificate verification. Shown when Enable TLS is true.                                                                           |
| TLS Certificate Authority File    | String  | No       | *(empty)* | Certificate authority used to validate TLS certificates. Shown when Enable TLS is true and certificate verification is not skipped.         |
| Server Name Override              | String  | No       | *(empty)* | Optional virtual hostname indicating the name of the server requested by the client. Generally not required. Shown when Enable TLS is true. |
| Mutual TLS                        | Boolean | No       | false     | Use mutual TLS authentication. Shown when Enable TLS is true.                                                                               |
| TLS Client Certificate File       | String  | No       | *(empty)* | A TLS certificate used for client authentication. Shown when Enable TLS and Mutual TLS are true.                                            |
| TLS Client Private Key File       | String  | No       | *(empty)* | A TLS private key used for client authentication. Shown when Enable TLS and Mutual TLS are true.                                            |

**Advanced**

| Parameter        | Type     | Required | Default | Description                                                                                                                                                                                 |
| ---------------- | -------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Poll Interval    | Duration | No       | 10s     | The interval to poll Bindplane for audit logs. Must be at least 10 seconds.                                                                                                                 |
| Parse Attributes | Boolean  | No       | false   | Parse audit log fields into individual log record attributes. When false, the body is the raw log message. Requires a collector with the `bindplaneauditlogs` receiver at v1.92.0 or later. |

### Examples

#### Collect audit logs from a Bindplane Cloud instance

This is the minimal configuration. It connects to `https://app.bindplane.com` and polls every 10 seconds using the provided API key.

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Cloud
    - name: bindplane_api_key
      value: <your-api-key>
```

#### Collect audit logs from a Self-Hosted instance over TLS

Reaches a self-hosted instance at `https://bindplane.internal:3001`, validates the server certificate with a CA file, and parses audit fields into attributes.

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Self-Hosted
    - name: bindplane_api_key
      value: <your-api-key>
    - name: bindplane_host_scheme
      value: https
    - name: bindplane_host_url
      value: bindplane.internal
    - name: bindplane_host_port
      value: "3001"
    - name: enable_tls
      value: true
    - name: ca_file
      value: /opt/tls/ca.crt
    - name: parse_attributes
      value: true
```

### Configuration Tips

* The API key determines which project's audit logs are collected. To collect audit logs from multiple projects, add one source instance per project, each with that project's API key.
* Set Poll Interval no lower than `10s`. Values below the minimum are rejected.
* Leave Parse Attributes off if you prefer to parse the raw body downstream, or turn it on to get structured attributes directly from the receiver. It requires a collector with the receiver at v1.92.0 or later.

### Troubleshooting

#### No audit logs are collected

Symptoms: the source connects but no log records arrive.

Solutions:

1. Confirm the API key is valid, unexpired, and belongs to an admin user in the target project.
2. Confirm audit activity has occurred in the project since the source started. Audit logs are scoped to the API key's project.

#### Authentication or connection errors (Self-Hosted)

Symptoms: the collector reports connection refused, timeout, or TLS handshake errors.

Solutions:

1. Verify the Host URL, Host Scheme, and Host Port match the instance. The default port is `3001`.
2. If the instance uses a private or self-signed certificate, supply the CA file, or enable Skip TLS Certificate Verification for testing only.

#### Parse Attributes has no effect

Symptoms: the log body remains the raw message even though Parse Attributes is enabled.

Solutions:

1. Confirm the collector includes the `bindplaneauditlogs` receiver at v1.92.0 or later. Earlier versions ignore this option.

### Standalone Source

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Self-Hosted
    - name: bindplane_api_key
      value: <your-api-key>
    - name: bindplane_host_scheme
      value: https
    - name: bindplane_host_url
      value: bindplane.internal
    - name: bindplane_host_port
      value: "3001"
    - name: enable_tls
      value: true
    - name: insecure_skip_verify
      value: false
    - name: ca_file
      value: /opt/tls/ca.crt
    - name: poll_interval
      value: 10s
    - name: parse_attributes
      value: false
```

### Related Resources

* [Bindplane Audit Logs receiver](https://github.com/observIQ/bindplane-otel-collector/tree/main/receiver/bindplaneauditlogs)
* [API Keys](https://docs.bindplane.com/cli-and-api/api-keys)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/bindplane-audit-logs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.