> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Console audit log

> This page describes how you can review the cloud audit log

export const Image = ({img, alt, size = "lg"}) => {
  const normalizedSize = ["sm", "md", "lg"].includes(size) ? size : "lg";
  return <div className={`ch-image-${normalizedSize}`}>
      <Frame>
        <img src={img} alt={alt} />
      </Frame>
    </div>;
};

Console activities are recorded in the audit log. If you have the Admin or Developer organization role, you can review the log and integrate it with your logging systems.

<h2 id="console-audit-log-ui">
  Access the console log via the user interface
</h2>

<Steps>
  <Step title="Select organization" id="select-org">
    In ClickHouse Cloud, navigate to your organization details.

    <Image img="https://mintcdn.com/private-7c7dfe99/Ph2XgLY43sq6v4yO/images/cloud/security/activity_log1.webp?fit=max&auto=format&n=Ph2XgLY43sq6v4yO&q=85&s=3a202d751e7adc8b841099cee8a59fe8" size="md" alt="ClickHouse Cloud activity tab" border width="843" height="616" data-path="images/cloud/security/activity_log1.webp" />

    <br />
  </Step>

  <Step title="Select audit" id="select-audit">
    Select the **Audit** tab on the left menu to see what changes have been made to your ClickHouse Cloud organization - including who made the change and when it occurred.

    The **Activity** page displays a table containing a list of events logged about your organization. By default, this list is sorted in a reverse-chronological order (most-recent event at the top). Change the order of the table by clicking on the columns headers. Each item of the table contains the following fields:

    * **Activity:** A text snippet describing the event
    * **User:** The user that initiated the event
    * **IP Address:** When applicable, this flied lists the IP Address of the user that initiated the event
    * **Time:** The timestamp of the event

    <Image img="https://mintcdn.com/private-7c7dfe99/Ph2XgLY43sq6v4yO/images/cloud/security/activity_log2.webp?fit=max&auto=format&n=Ph2XgLY43sq6v4yO&q=85&s=4fae73076cac5b5bb45041e78f603351" size="md" alt="ClickHouse Cloud Activity Table" border width="3034" height="2440" data-path="images/cloud/security/activity_log2.webp" />

    <br />
  </Step>

  <Step title="Use the search bar" id="use-search-bar">
    You can use the search bar provided to isolate events based on some criteria like for example service name or IP address. You can also export this information in a CSV format for distribution or analysis in an external tool.
  </Step>
</Steps>

<div class="eighty-percent">
  <Image img="https://mintcdn.com/private-7c7dfe99/Ph2XgLY43sq6v4yO/images/cloud/security/activity_log3.webp?fit=max&auto=format&n=Ph2XgLY43sq6v4yO&q=85&s=bd7446f6576fc567605fc7d85b9e249f" size="lg" alt="ClickHouse Cloud Activity CSV export" border width="776" height="94" data-path="images/cloud/security/activity_log3.webp" />
</div>

<h2 id="console-audit-log-api">
  Access the console audit log via the API
</h2>

You can use the ClickHouse Cloud API `activity` endpoint to obtain an export
of audit events. Further details can be found in the [API reference](/docs/products/cloud/api-reference/organization/get-list-of-available-organizations).

<h2 id="log-integrations">
  Log integrations
</h2>

You can use the API to integrate with a logging platform of their choice. The following have supported out-of-the-box connectors:

* [ClickHouse Cloud Audit add-on for Splunk](/docs/integrations/connectors/data-integrations/integrations/splunk)