NrAuditEvent: Query account audit logs

To view all changes to your New Relic account for a specific time frame, run this basic NRQL query:

SELECT * 
FROM NrAuditEvent 
SINCE 1 day ago

To query what type of change to the account users was made the most frequently during a specific time frame, include the actionIdentifier attribute in your query. For example:

SELECT count(*) AS Actions 
FROM NrAuditEvent 
FACET actionIdentifier 
SINCE 1 week ago

To query for information about created accounts and who created them, you can use something like:

SELECT actorEmail, actorId, targetId 
FROM NrAuditEvent 
WHERE actionIdentifier = 'account.create' 
SINCE 1 month ago

When you include TIMESERIES in a NRQL query, the results are shown as a line graph. For example:

SELECT count(*) 
FROM NrAuditEvent 
TIMESERIES facet actionIdentifier since 1 week ago

Query the top-level account in your New Relic organization.

To see all the changes made to users, you could use:

SELECT * 
FROM NrAuditEvent 
WHERE targetType = 'user' 
SINCE this month

If you wanted to narrow that down to see changes to user type, you could use:

SELECT * FROM NrAuditEvent 
WHERE targetType = 'user' 
  AND actionIdentifier IN ('user.self_upgrade', 'user.change_type') 
SINCE this month

To query updates for your synthetic monitors during a specific time frame, include the actionIdentifier attribute in your query. For example:

SELECT count(*) FROM NrAuditEvent 
WHERE actionIdentifier = 'synthetics_monitor.update_script' 
FACET actionIdentifier, description, actorEmail 
SINCE 1 week ago LIMIT 1000

For more information about this synthetic monitoring feature, see synthetic monitoring audit log.

To query what configuration changes were made to any workload, use the query below. The targetId attribute contains the GUID of the workload that was modified, which you can use for searches. Since changes on workloads are often automated, you might want to include the actorType attribute to know if the change was done directly by a user through the UI or through the API.

SELECT timestamp, actorEmail, actorType, description, targetId 
FROM NrAuditEvent 
WHERE targetType = 'workload' 
SINCE 1 week ago LIMIT MAX

The targetType attribute describes the object that changed, such as account, role, user, alert conditions or notifications, and logs. To generate a list of targetType values for your account, run the query below. Note that this query will only show targetTypes that have been touched.

SELECT uniques(targetType)
FROM NrAuditEvent
SINCE 90 days ago

To see detailed information about any user who made changes to the account during a specific time frame, include actorType = 'user' in the query. For example:

SELECT actionIdentifier, description, actorEmail, actorId, targetType, targetId 
FROM NrAuditEvent 
WHERE actorType = 'user' 
SINCE 1 week ago

To query account activities made by a specific person during the selected time frame, you must know their actorId. For example:

SELECT actionIdentifier 
FROM NrAuditEvent 
WHERE actorId = 829034 SINCE 1 week ago

To identify who (actorType) has made the most changes to the account, include the actorEmail attribute in your query. For example:

SELECT count(*) as Users 
FROM NrAuditEvent 
WHERE actorType = 'user' 
FACET actorEmail SINCE 1 week ago

To query updates from your synthetic monitors made by a specific user, include the actionIdentifier and actorEmail attribute in your query. For example:

SELECT count(*) FROM NrAuditEvent 
WHERE actionIdentifier = 'synthetics_monitor.update_script' 
FACET actorEmail, actionIdentifier, description 
SINCE 1 week ago LIMIT 1000

To see detailed information about changes to the account that were made using an API key during a specific time frame, include actorType = 'api_key' in the query. For example:

SELECT actionIdentifier, description, targetType, targetId, actorAPIKey, actorId, actorEmail 
FROM NrAuditEvent 
WHERE actorType = 'api_key' 
SINCE 1 week ago