Query account audit logs (NrAuditEvent)

As an additional security measure for managing your New Relic account, you can use the NrAuditEvent event to view audit logs that show changes to your New Relic account. This includes:

You can also use New Relic Alerts to be notified about changes to your New Relic account.

Account data security and retention

Use of audit log events do not require a paid subscription. All New Relic account subscriptions can query up to 13 months of account changes.

To ensure account security, the audit logging NRQL query only tracks changes to your currently selected account. It does not show audit log events for any associated sub-accounts. To query changes to another account or sub-account, select the account and run a NRQL query there.

Audit logging is different than configuring audit mode for your APM agent. APM audit mode records information about all data being transmitted from your app.

Run NrAuditEvent query

To track and view changes to your New Relic account:

  1. At any NRQL interface, run the following query, adjusting the time frame as needed up to thirteen months:
    SELECT * from NrAuditEvent SINCE 1 day ago
  2. To customize your query, use any of the available NrAuditEvent attributes.
  3. To be notified about account changes, create NRQL conditions with New Relic Alerts.

To query changes to another account or sub-account, select the account and run a separate NRQL query for that account.

For more help

Recommendations for learning more: