For longer log retention, contact [email protected].
Access and Filter Audit Logs
You can access audit logs from the Settings UI or directly from a Cost Report or Virtual Tag.- From the Settings UI
- From a Cost Report
- From a Virtual Tag
1
From the top navigation, select Settings.
2
In the left navigation, under General Settings, select Audit Logs.
Filter Audit Logs
1
On the Audit Logs screen, a table is displayed that contains a row for each audit log event. You can complete the following actions on this screen:
- Filter audit logs by Event (create, update, destroy), Object Type (Cost Report, Virtual Tag, or FinOps Agent Cost Recommendation action), Object (the object’s name), Workspace, User (or Team when using service tokens), and Source (the console or API).
- Filter audit logs based on a date range, up to 24 months.
- View more details for an audit log.
Business Metrics: When you assign or remove a Business Metric from a Cost Report, or change Business Metric settings (such as label filters or unit scale), these changes are tracked in audit logs under the associated Cost Report. Changes to the default forecast selection (choosing which Business Metric forecast to display) are also tracked as updates to the Cost Report.
2
Select any row in the table to view more details. On the details screen, you can view more details about each event.
FinOps Agent Audit Logs
When the FinOps Agent takes action on savings recommendations, detailed audit log entries are created. FinOps Agent actions are visually distinguished in the audit log table with a different object icon, making it easy to identify agent actions at a glance. Within the Vantage Audit Logs, you can see the following information for each FinOps Agent action:- Time the recommendation was provided: When the Agent first identified and presented the savings opportunity
- Time the recommendation was approved: When a user approved the remediation action (if Owner Approval mode is enabled)
- Vantage User that approved the remediation: The user who approved the action (only applicable in Owner Approval mode)
- What Resources were altered: The specific resources that were modified as part of the recommendation remediation
- Time the action was taken in the cloud provider: When the action was executed in your cloud environment
Audit Log Metadata and Details
All audit logs contain the following object metadata at the top of the log.| Field | Description | Log Type | Example Value(s) |
|---|---|---|---|
| Object Type | What type of object was updated. | All | Cost Report; Virtual Tag |
| Workspace | Workspace where the object belongs, or in the case of Virtual Tags, what workspace the user took the action from. | All | Management |
| User/Team | The name of the user or team that performed the action. When using a service token (Team token), this field displays as Team and shows the team name. Any actions taken by Vantage Support will be denoted as Vantage Support. | All | Firstname Lastname; Team Name |
| User Role/Team Role | The role of the user or team. When using a service token, this field displays as Team Role and shows the team name. For users, this shows their role (Admin, Member, etc.). | All | Admin; Member; Team Name |
| Source | Where the action originated. Console indicates actions taken through the Vantage web interface. API indicates actions taken via the Vantage API or Terraform provider, including actions performed using service tokens. | All | Console; API |
When actions are performed using a service token (Team token), the audit log displays Team and Team Role fields instead of User and User Role. The Source field will show API to indicate the action was performed via the API using a service token. The team name is displayed in both the Team and Team Role fields.
Object Details
Two sections are displayed to indicate what has been changed or not changed on the object. These tables list the values updated by the user. When a value or setting changes, both the previous and new values appear in the object details. In the example below, the date binning, date interval, and report groupings have all been updated.
| Field Name | Description | Report | Example |
|---|---|---|---|
| Account | The account associated with the Virtual Tag. | Virtual Tag | Vantage |
| Backfill Until | The date until which historical data is populated in a Virtual Tag. | Virtual Tag | Jul 31, 2025, 20:00:00 |
| Change Unit | How period-over-period changes are displayed: as a percentage or as a currency amount. In audit logs, this may appear as 0 (percentage) or 1 (currency). | Cost Report | 0 (percentage), 1 (currency) |
| Chart Settings | Configuration settings for the chart visualization. | Cost Report | {"x_axis_dimension": ["date"], "y_axis_dimension": "cost"} |
| Chart Type | The type of chart visualization used for the report. | Cost Report | area, line, pie, bar, multi_bar |
| Created At | When the object was originally created. | Cost Report and Virtual Tag | Feb 24, 2025, 15:36:57 |
| Created By | The user who created the object. | Cost Report and Virtual Tag | First Last |
| Created By Type | Type of user who created the object: User or Team (Service Token). | Cost Report and Virtual Tag | User |
| Date Bucket | The date binning used for the chart (how dates are grouped). | Cost Report | cumulative, day, week, month, quarter |
| Date Interval | The date interval of the report. | Cost Report | last_month |
| Default Forecast | The Business Metric selected as the default forecast for the Cost Report. | Cost Report | User Sessions |
| Filter | The conditions used to filter the report’s data. | Cost Report | (costs.provider = 'azure' AND costs.allocation = 0.0 AND costs.region IN ('germany', 'eastus') |
| Grouping Filter | Additional filter applied to the grouping dimension. | Cost Report | service = 'EC2' |
| Groupings | What the report is grouped by. | Cost Report | ["provider","tag:container"] |
| Key | The name of the Virtual Tag key. | Virtual Tag | Test Tag |
| Labels | The label filters applied to a Business Metric on a Cost Report. | Cost Report | ["app1", "app2"] |
| Previous Period Start Date/ Previous Period End Date | Separate fields for start and end date set for previous period on report. | Cost Report | 2025-01-26 |
| Refreshed At | When the object was last refreshed. | Cost Report and Virtual Tag | Aug 13, 2025, 12:59:17 |
| Referenced Tag Keys By Provider | Mapping of tag keys referenced per provider. | Virtual Tag | {"aws": []} |
| Settings | Define how the report is displayed or calculated. | Cost Report | {"include_credits": false, "include_refunds": false, "include_discounts": true, "include_tax": true, "unallocated": false, "amortize": true, "show_previous_period": true, "aggregate_by": "cost"} |
| Start Date/ End Date | Separate fields for start and end date set for report. | Cost Report | 2025-01-26 |
| Table Layout | How the cost table is displayed: cumulative view or by date view. In audit logs, this may appear as 0 (cumulative_view) or 1 (by_date_view). | Cost Report | 0 (cumulative_view), 1 (by_date_view) |
| Title | The title of the report. | Cost Report | My Cost Report |
| Token | Unique identifier for the object. | Cost Report and Virtual Tag | rprt_12345abcde67890f, vtag_82741abfce690354 |
| Unit Scale | The unit scale applied to a Business Metric on a Cost Report (per unit, per hundred, per thousand, etc.). | Cost Report | per_thousand |
| User VQL | Custom Vantage Query Language (VQL) query used to filter the report’s data. | Cost Report | (costs.provider = 'aws' AND costs.service = 'EC2') |
Share Audit Logs
You can share an audit log with other Vantage users. The log detail page has a unique URL that allows you to share log events with any authenticated Vantage user who has access to audit logs (i.e., Owners). A URL looks similar to:https://console.vantage.sh/settings/audit_logs/adt_lg_123a4f5a6c7dab94.