Read the audit trail
See who changed or tried to change a cache, and when.
In short
The Audit tab lists everything that changed, or tried to change, a connection's server through {{brand}} - who, what and when. Reads leave no trace. On a Production connection, reading a key or running a reading command is recorded too, as a Production read.
Before you start
- Who: anyone who can open the connection.
- Plan: every plan.
- First: nothing. Reads leave no trace, so only changes and refusals are listed.
Steps
- Select a connection and open the "Audit" tab. Newest first, 50 to a page.
- Narrow the whole trail with the chips - Writes, Deletes, Flushes, Commands, Production reads, Refused, Settings - or type part of a key in the search. Each chip counts its entries and shows once the trail holds that kind.
- Read the color: green succeeded, amber means the server reported a failure, red was refused by policy.
- Click a row to read the entry in full beside the trail - the whole command or refusal, the tier and the exact time. Press J and K to step through the entries.
- Click a key to open it on the Keys tab.
- Keep a narrowing you use often with "Save as view" in the views menu; share it with your organization if others need it too.
Good to know
- The trail is kept forever, but deleting the connection takes it out of reach.
- Who is the person's name. Someone is a person you cannot see, such as one who left the organization; System is an action not tied to a person.
- Scanning and inspecting are not listed.
Example: who cleared Staging? On Monday the Staging cache is empty. The newest line is a red Refused from Dana: a flush stopped by the tier rule. Two lines down, a green Delete by pattern on db0 with catalog:* reads Removed 41,207 matching key(s) - that is what emptied it. The lead marks the connection Read-only until the test run ends.
Related
- /help/cache-tester/delete-keys
- /help/cache-tester/connection-tiers
- /help/cache-tester/raw-commands-safety-and-audit