Viewing events in Audit Logs

An audit event is a data record that captures something that happened in Nebius AI Cloud, along with metadata that provides additional context. The metadata shows how events relate to resources or to each other. Each event in Audit Logs has a JSON representation that conforms to the CloudEvents specification.

You can use the Nebius AI Cloud web console or CLI to view and filter audit events for your tenant.

Prerequisites

Make sure you are in a group that has the admin or auditlogs.audit-event-viewer role within your tenant. You can check this in the Administration → IAM section of the web console.

How to view events

Web console

In the sidebar, go to Administration → Audit Logs. To work with the events on this page, you can do the following:

• On the Logs tab:

  • Select the event type: Control plane or Data plane. Control plane events track management operations on resources (such as creating or deleting virtual machines). Data plane events track data access operations (such as reading or writing objects in Object Storage).
  • View event JSONs. To do this, click  in an event’s row.
  • Filter events by period or by using filters. Click  Filters and select the filters you need.

• On the Metrics tab:

  • Select the event type: Control plane or Data plane.
  • View the number of events processed per second in a specific region and time period.
  • Only for data plane events, view information related to quota usage. For more information, see Quotas in Audit Logs.

CLI

1. To copy the ID of the required tenant, view your list of tenants:

   nebius iam tenant list
   

2. Get all events in the tenant:

   nebius audit v2 audit-event list \
      --parent-id <tenant_ID> \
      --start <time_in_ISO_8601> \
      --end <time_in_ISO_8601>
   

   Start and end dates are required and must be in the ISO 8601 format. For example, to get all the events that happened in March 2025, run the following command:

   nebius audit v2 audit-event list --parent-id <tenant_ID> \
     --start 2025-03-01T00:00:00Z \
     --end 2025-04-01T00:00:00Z
   

3. (Optional) By default, only control plane events are shown.

   • Control plane events (default): Track management operations on resources, such as creating, updating or deleting virtual machines, clusters or other infrastructure resources.

   • Data plane events: Track data access operations, such as reading or writing objects in Object Storage buckets.

   To view data plane events, specify data_plane in the --event-type parameter:

   nebius audit v2 audit-event list \
      --parent-id <tenant_ID> \
      --start <time_in_ISO_8601> \
      --end <time_in_ISO_8601> \
      --event-type data_plane
   

4. (Optional) To narrow down events, use filters.