# Sonarqube Audit logs **URL:** \ **Category:** SonarQube Server / Community Build\ **Created:** [September 18, 2024, 10:03pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363 "2024-09-18T22:03:39Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![shravankarthik](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/shravankarthik/32/6300_2.png) [@shravankarthik](https://community.sonarsource.com/u/shravankarthik)\ **Post date:** [September 18, 2024, 10:03pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/1 "2024-09-18T22:03:39Z")
We are trying to analyze Sonarqube audit logs. I am able to get audit logs calling api. Audit logs contain login information only. Is there a way to get logout information for each user? ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 20, 2024, 3:32pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/2 "2024-09-20T15:32:32Z")
Hi, In our experience, user sessions are more likely to expire than to be logged out of. We focused on the logins.   HTH, Ann ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 23, 2024, 4:26pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/3 "2024-09-23T16:26:40Z")
Hi again, In fact, I was misreading the audit logs I was looking at. It turns out that we log _neither_ login nor logout. Could you share why you’re interested?   Thx, Ann ---
**Author:** ![shravankarthik](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/shravankarthik/32/6300_2.png) [@shravankarthik](https://community.sonarsource.com/u/shravankarthik)\ **Post date:** [September 23, 2024, 4:51pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/4 "2024-09-23T16:51:09Z")
I do see login information in the audit logs. We had a security issue recently and want to track login and logout for user information. Below is the log information we see from audit log retrieved from sonarqube api: I removed values that are internal to out organization { “userLogin”: “”, “createdAt”: “2024-08-25T19:00:21-0500”, “userUuid”: “”, “userTriggered”: true, “category”: “USER\_TOKEN”, “operation”: “DELETE”, “previousValue”: { “userLogin”: “”, “userUuid”: “”, “tokenName”: “” } }, ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 23, 2024, 5:06pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/5 "2024-09-23T17:06:57Z")
Hi, Yeah… I thought that at first too. But the important part is not > [@shravankarthik](#): > > “userLogin”: “”, That’s just the _who_. Here’s what actually happened: > [@shravankarthik](#): > > “category”: “USER\_TOKEN”, > “operation”: “DELETE”, It reads better if we rearrange it: ```auto “userLogin”: “foo”, “operation”: “DELETE”, “category”: “USER_TOKEN”, ```   Ann ---
**Author:** ![shravankarthik](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/shravankarthik/32/6300_2.png) [@shravankarthik](https://community.sonarsource.com/u/shravankarthik)\ **Post date:** [September 23, 2024, 5:30pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/6 "2024-09-23T17:30:31Z")
The field createdAt, isnt this the time of login ? “createdAt”: “2024-08-25T19:00:21-0500”, ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 23, 2024, 5:37pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/7 "2024-09-23T17:37:24Z")
Hi, It’s the time the user took the action in question. From the answer I got when I asked about this internally: > …audit logs are meant to track changes. So we do track account updates, token creations, permission changes, etc. Login/out events are not changes per se so if the question arose back then, I guess that was the explanation to not track them. > > Login events are outputted in _web.log_ in DEBUG mode, and last connection date is also updated (at least once an hour). This is nothing as usable as audit logs but just to list what we have. Again, would you mind sharing why you want / need to track login and logout?   Thx, Ann ---
**Author:** ![shravankarthik](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/shravankarthik/32/6300_2.png) [@shravankarthik](https://community.sonarsource.com/u/shravankarthik)\ **Post date:** [September 23, 2024, 6:16pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/8 "2024-09-23T18:16:28Z")
Ok. Is there an api available to weblog that has login and logout information. For your question “ **would you mind sharing why you want / need to track login and logout?** ”, answer is “We had a security issue recently and want to track login and logout for user information.”. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 23, 2024, 6:17pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/9 "2024-09-23T18:17:41Z")
Hi, There’s no API for that. You’ll need file system access. The logs are in `$SONARQUBE-HOME/logs`.   HTH, Ann ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 24, 2024, 2:02pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/10 "2024-09-24T14:02:30Z")
Hi again, It turns out I was wrong (again!). There apparently is an API: [api/system/logs](https://next.sonarqube.com/sonarqube/web_api/api/system/logs).   Ann ---
**Author:** ![shravankarthik](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/shravankarthik/32/6300_2.png) [@shravankarthik](https://community.sonarsource.com/u/shravankarthik)\ **Post date:** [September 24, 2024, 3:19pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/11 "2024-09-24T15:19:37Z")
Thanks . I will check it out . ---
**Author:** ![shravankarthik](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/shravankarthik/32/6300_2.png) [@shravankarthik](https://community.sonarsource.com/u/shravankarthik)\ **Post date:** [September 24, 2024, 5:35pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/12 "2024-09-24T17:35:59Z")
I tried looking up access and web logs but i did not find any relevant information with users in logs. Please suggest if i am missing something /api/system/logs?process=web /api/system/logs?process=access ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 24, 2024, 5:40pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/13 "2024-09-24T17:40:08Z")
Hi, > [@ganncamp](#): > > Login events are outputted in _web.log_ in DEBUG mode, Default logging mode is `INFO`, so you’re not likely to be able to pull this retroatively. You would need to bump the log level up to be able to pull this info in the future. But be aware that there’s no way to set the level for logs individually, so you’ll set them all to `DEBUG`, and in `DEBUG` mode, they get big, fast.   HTH, Ann ---
**Author:** ![shravankarthik](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/shravankarthik/32/6300_2.png) [@shravankarthik](https://community.sonarsource.com/u/shravankarthik)\ **Post date:** [September 24, 2024, 5:51pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/14 "2024-09-24T17:51:44Z")
Makes sense. Thanks . ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [September 25, 2024, 12:56pm UTC](https://community.sonarsource.com/t/sonarqube-audit-logs/125363/15 "2024-09-25T12:56:47Z")
Hi again, I… keep being wrong on this topic. If you adjust the log level via the UI (Administration → System) then you set all logs at once. But I was just looking through `$SONARQUBE-HOME/conf/sonar.properties` and was reminded that at that level, you can set the logging levels individually: ```auto # Level of logs of each process can be controlled individually with their respective properties. # When specified, they overwrite the level defined at global level. # Supported values are INFO, DEBUG and TRACE #sonar.log.level.app=INFO #sonar.log.level.web=INFO #sonar.log.level.ce=INFO #sonar.log.level.es=INFO ``` Note that this requires file system access and a restart to kick in.   HTH, Ann