The audit log is a complete record of your Burrow, built in and included with every Burrow. Every sign-in, every change to a project, secret, machine, member, role or setting, every value revealed and every secret a machine reads, every attempt that was refused, and everything the Burrow does on its own lands here. Each entry says who acted, what happened, when, where the request came from, and whether it went through.
It records over 130 kinds of event, keeps them for as long as you choose, and can export them or send them anywhere the moment they happen. The full list is at the end of this page.
What it gives you#
Who did what, always. Who changed a secret, revealed a value, gave a machine access, changed someone's role, or turned a setting off. Every entry names the person or machine as they were named at the time, and entries are never changed once written.
Every read accounted for. Each value a member reveals and each secret a machine reads is its own entry, naming the version or field read and the client that read it, such as Python SDK 1.0.1 or CLI 0.4.2.
The attempts that failed. Machine requests with a bad signature, machines calling from an address outside your allowlist, refused enrollments, wrong passphrases on a share link, and addresses refused or locked out by a rate limit. They sit beside the actions that went through, tagged Denied or Failed.
Early warning. A machine reading a canary is recorded as Critical, together with the machine it disabled, so a leaked credential shows up the moment it is used.
Where it came from. Every entry carries the address of the request. With IP data on, it also shows the country's flag, the city and country, and the network it belongs to.
What the Burrow did by itself. Scheduled backups, automatic rotations, machines and tokens expiring, dynamic secret logins removed at the end of their lease, certificates renewing and old events being cleared are recorded under System.
History on your terms. Events are kept until you decide otherwise. Turn on retention to clear them after a period you choose.
Out of the Burrow when you need it. Export any part of it as CSV, JSON or TXT, or send events to Slack, Discord or your own endpoint as they happen with webhooks.
Opening it#
Select Audit log in the navigation. Anyone whose role can read the audit log sees every event, newest first, ten to a page. New events appear on the first page as they happen, without reloading. Use Previous and Next to move through the pages, or select the page number and type the page you want.
Who acted#
Every entry names whoever acted:
Actor | What it is |
|---|---|
Humans | Members signing in, managing projects, secrets, machines and members, and changing settings. |
Machines | Servers, applications and workflows reading secrets, enrolling and ending their own lifetime. |
AI identities | AI agents given their own identity to act in the Burrow. |
Share links | Someone opening a share link without being signed in. A signed-in member opening one is recorded under their own name. |
System | The Burrow itself, for what happens on its own: scheduled backups, automatic rotation, expiry, dynamic secret logins ending with their lease, rate-limit lockouts and retention. |
Reading an entry#
Column | Shows |
|---|---|
Event | A plain sentence of what happened, led by who did it, with a coloured dot for its severity. A refused action carries a Denied tag and one that errored a Failed tag. A secret read by a machine also shows the client that read it. |
Source | The address the request came from. With IP data on, the country's flag sits before it, with the city, country and network underneath. Something the Burrow did by itself, with no request behind it, reads System. |
When | The time it happened, in the format chosen under Display. |
Severity#
Every event carries one of five levels, shown as the coloured dot beside it. The level comes from the kind of action. Whether it went through, was denied or failed is shown separately, as a tag on the event.
Level | Typical events |
|---|---|
Info | Reads, listings, checks and routine housekeeping. |
Notice | Everyday changes, such as creating or renaming, and signing in and out. |
Warning | Deletions, refused requests, and sensitive changes such as creating a machine token, opening a share link or rotating the master key. |
High | Who can get in and protected material: members and roles, passwords and two-factor, SSO, the sign-in rule, machine requests with a bad signature, address lockouts, a share link destroyed by guessing, a dynamic secret login the Burrow stopped trying to remove, and downloading or restoring a backup. |
Critical | A machine reading a canary. |
Finding an event#
Filters sit above the list and combine, and the count and pages follow whatever you set.
Filter | What it does |
|---|---|
Search | Matches text anywhere in the event, including the action and what it acted on. |
Actor | Narrows to a class of actor (Humans, Machines, AI Identities, Share links or System) or to one person or machine. Type in its search box to find one. |
Severity | Shows a single severity level. |
Event type | Selects one or more kinds of event, with a search box. Each option shows how many times it has occurred. |
IP address | Matches the source address. |
The trail for one machine or secret#
You can open the log already narrowed to a single machine or secret. Both open for the same roles that can read the audit log.
For a machine, open the Machines page, use its row menu, and select Audit logs. You see every secret it read and every change made to it. See Machine grants.
For a secret, open its environment in Projects, use the secret's row menu, and select Audit History. You see when it was created, every reveal and read, and each value change, revert, rename, rotation, share link and deletion. For a dynamic secret, it also shows every login issued, renewed, put back and removed.
A secret's row menu also has Version History, which lists its saved values and can restore an earlier one. Audit History records who did what and never shows a value.
Exporting#
Anyone who can read the audit log can export it. Select the download button at the end of the filter bar. The export opens with the filters already set on the page, and you can change any of them first.
Setting | Options |
|---|---|
Format | CSV, JSON or TXT. |
Time period | The last 24 hours, 7, 30 or 90 days, all time, or a custom range of dates. |
Events | One or more kinds of event, or all of them. |
Actors | Any mix of whole classes of actor and individual people or machines, or all of them. |
Severity | All levels, or any combination of them. |
Search and IP address | The same matching as the filters on the page. |
The line beside the Export button shows how many events the file will hold, and follows the settings as you change them. Select Sample to see the shape of the chosen format first.
Format | What the file holds |
|---|---|
CSV | One row per event: time, severity, outcome, action, summary, actor, target, source address, location and client. For spreadsheets and SIEM tools. |
JSON | A header naming the Burrow and its version, who exported it and when, the time range and the filters used, then every event with all of its fields. |
TXT | The same header, then each event as a readable log line with its summary beneath. |
Times in the file are in UTC, and the file is named for its range, for example burrow-audit_2026-08-25_2026-09-24.csv. In a CSV file, a value a spreadsheet would run as a formula is written as plain text. The file holds the events that existed when the export started. Exporting is itself recorded, with the format, the number of events and the filters used.
Sending events elsewhere#
Every event in this log can go to Slack, Discord or a signed endpoint of your own the moment it is recorded. Choose all events, whole groups such as secret.*, or single events by their code. See Webhooks.
Retention#
Out of the box nothing is ever deleted. To clear old events, open Settings, then Security, and turn on Audit Log Retention. Set the period in days, weeks, months or years, up to ten years, and select Save. Before a change that would delete events takes effect, you're shown how many it would delete right now.
Events older than the period are cleared straight after you turn it on and every hour after that. Each clearing is recorded with how many events went, and turning retention on, off or changing its period is recorded too. Changing retention needs permission to delete audit logs.
What gets recorded#
Every event the Burrow records, grouped by what it concerns. The code is what the event type filter, exports and webhooks use.
Projects and environments#
Event | Code | Severity |
|---|---|---|
Project created |
| Notice |
Project renamed |
| Notice |
Project description set, changed or removed |
| Info |
Projects reordered |
| Info |
Project deleted |
| Warning |
Environment created |
| Notice |
Environment renamed |
| Notice |
Environment deleted |
| Warning |
Secrets#
Event | Code | Severity |
|---|---|---|
Value set or changed |
| Notice |
Value revealed by a member or read by a machine, with the version and field |
| Info |
An environment's secrets listed |
| Info |
Secrets reordered |
| Info |
Reverted to an earlier version |
| Notice |
Renamed, along with its linked copies |
| Notice |
Linked copy created in another environment |
| Notice |
Unlinked from its copies |
| Notice |
Deleted |
| Warning |
Rotated automatically, or a rotation failed |
| Notice, Warning when it failed |
Automatic rotation turned on or changed |
| Notice |
Automatic rotation turned off |
| Warning |
Canary armed or disarmed |
| Warning |
Canary read by a machine |
| Critical |
Dynamic secrets#
Each login a dynamic secret gives a machine is recorded from the moment it starts being issued until it is removed, and each certificate an SSH user secret issues from when it's issued until it's revoked, in the secret's own Audit History too.
Event | Code | Severity |
|---|---|---|
A machine's read started issuing it a login |
| Info |
Login issued to a machine, or issuing it failed |
| Notice, Warning when it failed |
Login extended by a machine's read |
| Info, Warning when the database or node refused the new expiry |
Login missing from its database, or no longer as issued, put back, such as after Redis restarts |
| Notice, Warning when it couldn't be checked |
Login removed from its database or Windows host, at the end of its lease or by hand |
| Notice, Warning when it failed, High when the Burrow stopped trying once the login's own expiry had already ended it, or its node was force removed |
Lease policy, password, or issuing on or off changed |
| Notice |
Connection and grants tested, or a test account made on a node |
| Info |
SSH user secret created, with the certificate authority it issues from |
| Warning |
Certificate issued to a machine |
| Notice |
Certificate revoked, with why |
| Notice |
Rotated secrets#
Each change of a rotated secret's password is recorded as it starts and as it ends, however it went, with the account and its node or server. The password itself is never recorded.
Event | Code | Severity |
|---|---|---|
Rotated secret created, or its host, services, account, node or connection changed |
| Notice |
An account's password checked where the account is, before a secret is saved or moved |
| Info, Warning when it isn't the account's or couldn't be checked |
A new password started on its way to the account, or was sent again |
| Info |
How a change went: rotated, verified after a restore, failed, waiting for its node or server, unconfirmed, restored to the previous password, needing attention, or lost when the secret was deleted during the change |
| Notice when rotated, Warning with a note; Info when verified; High when it needs attention or was lost; Warning otherwise |
A check of a Redis user put its password back or took other passwords off, found something it couldn't put right, or found everything right again after that |
| Warning, Info when everything is right again |
A database server's roles or users listed through an admin connection, for a rotated secret's form |
| Info |
A node's accounts listed for a rotated secret's form |
| Info |
Share links#
Event | Code | Severity |
|---|---|---|
Share link created |
| Warning |
A secret's share links viewed |
| Notice |
Share link opened |
| Warning |
Opening refused: a wrong passphrase, or a members-only link opened by someone who isn't one |
| Warning |
Share link destroyed after too many wrong passphrases |
| High |
Share link revoked |
| Notice |
Share link expired |
| Info |
Machine reads and refusals#
Each secret a machine reads is also its own secret.read entry, naming the client that read it.
Event | Code | Severity |
|---|---|---|
A machine listed the projects it can read |
| Info |
A machine listed the secrets it can read |
| Info |
A machine read a whole environment |
| Info |
A machine started watching everything it can read |
| Info |
A machine started watching an environment |
| Info |
A machine request refused at sign-in |
| Warning, High for a bad signature or a replayed request |
A machine refused for calling from an address outside the allowlist |
| Warning |
Machines#
Event | Code | Severity |
|---|---|---|
Machine added through an invitation |
| Notice |
GitHub Actions, GitLab CI/CD or Bitbucket Pipelines machine added |
| Notice |
Machine enrolled through a machine token |
| Notice |
Machine approved |
| Notice |
Machine renamed |
| Notice |
Machine disabled |
| Warning |
Machine enabled |
| Notice |
Machine revoked |
| Warning |
Project access granted, changed or removed |
| Warning |
Machine disabled by a canary it read |
| High |
Machine reached the end of its lifetime |
| Info |
Machine ended its own lifetime |
| Info |
Expired machines removed after about a month |
| Notice |
Invitations and machine tokens#
Event | Code | Severity |
|---|---|---|
Machine invitation created |
| Notice |
An invitation's command copied again |
| Notice |
Invitation revoked |
| Notice |
Registration through an invitation refused |
| Warning |
Machine token created, with its grants |
| Warning |
A machine token's command copied again |
| Warning |
Machine token revoked |
| Notice |
Machine token expired |
| Notice |
Enrollment through a machine token refused, with the reason |
| Warning |
Custom domain saved to the URL list, the first time it is used |
| Info |
Saved custom domain removed from the URL list |
| Notice |
Certificate authorities#
Every change to your certificate authorities, by a member or on a CA's own rotation schedule.
Event | Code | Severity |
|---|---|---|
Certificate authorities listed |
| Info |
A CA's details opened |
| Info |
CA created |
| Notice |
CA renamed |
| Notice |
CA disabled |
| Warning |
CA enabled |
| Notice |
Rotation settings changed |
| Notice |
New key prepared, by a member or on the CA's rotation schedule |
| Notice |
Switched to the new key, by a member or after the switch delay |
| Notice |
Waiting key removed |
| Notice |
Signing key replaced at once |
| Warning |
An old key left the trust anchor, once everything it signed had expired |
| Notice |
CA deleted |
| Warning |
CA restored |
| Notice |
Deleted CA removed for good with its keys |
| Notice |
Nodes attached or detached, when the CA is created and on every change after |
| Warning |
Nodes#
Each node's token, registration and connections, and every instruction your Burrow sends it, with how it answered.
Event | Code | Severity |
|---|---|---|
Nodes listed |
| Info |
Node token made |
| Notice |
Node token shown again |
| Notice |
Node token revoked |
| Notice |
Node registered with a token |
| Notice |
A registration refused, with why |
| Warning |
Node approved |
| Notice |
Node disabled |
| Warning |
Node enabled |
| Notice |
Node renamed |
| Notice |
Node removed, or its removal started, with the CAs it was detached from and the logins it removes first |
| Warning |
Node confirmed its SSH trust is off its host, with no login left there, and was removed |
| Notice |
Node force removed, without waiting for it |
| Warning |
Node connected |
| Info |
Node disconnected, with how |
| Info |
A connection refused. The same refusal again within the hour is counted on the next entry. |
| Warning, High when it may not have come from the node |
Node reported a new version, host name or platform |
| Info, Warning when its platform changed |
An instruction sent, and how the node answered it, with what it changed on its host |
| Info, Warning when it couldn't carry it out or didn't answer |
Members and roles#
Event | Code | Severity |
|---|---|---|
Someone invited, on a role |
| High |
Member moved to another role |
| High |
Member's access cut or restored |
| High |
Member removed, or an invitation withdrawn |
| High |
Member list viewed |
| Info |
Custom role created or changed |
| High |
Custom role deleted |
| High |
Roles viewed |
| Info |
Single sign-on#
Event | Code | Severity |
|---|---|---|
Single sign-on settings opened |
| Info |
Single sign-on changed: the identity provider, a domain, a linked identity or group mappings |
| High |
SCIM token created or revoked |
| High |
Sign-in#
See Sign-in.
Event | Code | Severity |
|---|---|---|
Sign-in settings opened |
| Info |
Second factor required, changed or no longer required, with the accepted factors and how many sessions it signed out |
| High |
Sign-in, sessions and accounts#
Event | Code | Severity |
|---|---|---|
Burrow claimed |
| High |
Logged in |
| Notice |
Logged out |
| Notice |
A session logged out from the sessions page |
| Warning |
Every other session logged out at once |
| Warning, High when it reached other members |
Password changed |
| High |
Authenticator app turned on |
| High |
Authenticator app turned off |
| High |
GitHub sign-in disconnected |
| High |
Username changed |
| Notice |
Profile image changed |
| Info |
Feedback sent to RatelKey |
| Info |
Network and remote access#
Event | Code | Severity |
|---|---|---|
Restrict to local network turned on or off |
| Warning |
Relay fallback turned on or off |
| Notice |
Router port forwarding turned on or off |
| Warning when on, Notice when off |
Domain changed |
| Notice |
Certificate replaced: uploaded, self-signed or from Let's Encrypt, including renewals |
| Warning |
Burrow restarted |
| Notice |
Security and rate limits#
Event | Code | Severity |
|---|---|---|
Machine and node approval, or invitation expiry, changed |
| Notice |
Machine IP allowlist turned on or off |
| High |
Address added to the allowlist |
| Notice |
Address removed from the allowlist |
| Notice |
Rate limits page opened |
| Info |
A rate limit changed |
| Warning |
Network exempted from the per-address limit |
| Warning |
Exemption removed |
| Notice |
Requests refused by a rate limit, counted per address each minute |
| Warning |
Address locked out |
| High |
Lockout lifted |
| Notice |
Backups#
Event | Code | Severity |
|---|---|---|
Backup taken |
| Info |
Backup failed, with the reason |
| Warning |
Backup downloaded |
| High |
Backup checked |
| Info |
Backup deleted |
| Notice |
Schedule, how many to keep, or location changed |
| Notice |
Burrow restored from a backup |
| High |
Backup passphrase set or replaced |
| High |
Encryption and keys#
Event | Code | Severity |
|---|---|---|
Master key rotated |
| Warning |
Master key sealed to this machine's TPM |
| Warning |
Master key moved from the TPM to a key file |
| Warning |
Burrow config, IP data and updates#
Event | Code | Severity |
|---|---|---|
Burrow config saved: display name and auto-install updates |
| Notice |
Time format changed |
| Notice |
Telemetry reports changed |
| Notice |
MaxMind credentials saved |
| Warning |
MaxMind credentials removed |
| Notice |
IP data turned on |
| Notice |
IP data turned off |
| Notice |
IP databases updated by hand |
| Info |
Checked for updates |
| Info |
Update installed |
| Notice |
Webhooks#
Event | Code | Severity |
|---|---|---|
Webhook created |
| Notice |
Webhook changed |
| Notice |
Webhook deleted |
| Warning |
Signing secret revealed |
| Warning |
Test sent |
| Info |
Burrow note#
Event | Code | Severity |
|---|---|---|
Note posted |
| Notice |
Note edited |
| Notice |
Note deleted |
| Notice |
Console#
See Console.
Event | Code | Severity |
|---|---|---|
Console opened |
| Info |
Log file downloaded |
| Warning |
Audit log#
Event | Code | Severity |
|---|---|---|
Audit log exported |
| Notice |
Retention turned on or off, or its period changed |
| Warning when on, Notice when off |
Events older than the retention period cleared |
| Notice |