Query account audit logs (NrAuditEvent)

As an additional security measure for managing your New Relic account, you can use the NrAuditEvent event in New Relic Insights to view audit logs that show changes to your account for the selected time frame. This includes:

You can also use New Relic Alerts to be notified about changes to your New Relic account.

Account data security and retention

Insights audit logging events do not count toward your Insights subscription usage. All New Relic account subscriptions, both paid and free, can query up to thirteen months of account changes at no extra charge.

To ensure account security, the audit logging NRQL query only tracks changes to your currently selected account. It does not show audit logging events for any associated sub-accounts. To query changes to another account or sub-account, select the account, then run another NRQL query.

Insights audit logging is different than configuring audit mode for your APM agent. APM audit mode records information about all data being transmitted from your app.

Run NrAuditEvent query

To track and view changes to your New Relic account:

  1. Go to insights.newrelic.com.
  2. Run the following NRQL NrAuditEvent query, adjusting the time frame as needed up to thirteen months:

    SELECT * from NrAuditEvent SINCE 1 day ago
  3. To customize your query, use any of the available NrAuditEvent attributes.
  4. To view or share the audit logs, create Insights dashboards.
  5. To be notified about account changes, create NRQL conditions with New Relic Alerts.

Query another account or sub-account

To view audit logging events for another New Relic account or sub-account:

  1. From the account dropdown in the New Relic UI, select Switch account > (select an account).
  2. Run a new NRQL NrAuditEvent query.

For more help

Recommendations for learning more: