What are audit logs?
注意
在特定用例中，Webhook 可能是审核日志或 API 轮询的良好替代方法。 Webhook 是一种 GitHub 在存储库、组织或企业发生特定事件时通知服务器的方法。 与 API 或搜索审核日志相比，如果只想了解企业、组织或存储库何时发生某些事件并进行相应记录，Webhook 效率更高。 请参阅“Webhook 文档”。
审核日志列出了由影响企业的活动触发的事件。 GitHub 的审核日志将无限期保留，除非企业所有者配置了不同的保留期。 请参阅 为企业配置审核日志。
默认情况下，仅显示过去三个月的事件。 若要查看较旧的事件，必须使用 created 参数指定日期范围。 请参阅“了解搜索语法”。
每个审核日志条目的名称由事件类型组成，后跟操作类型。 例如，repo.create 条目是指对 repo 类别的 create 操作。
每个审核日志条目都显示有关事件的适用信息，例如：
- 执行操作的企业或组织
- 执行操作的用户（参与者）
- 受操作影响的用户
- 执行操作的仓库
- 执行的操作
- 发生操作的国家/地区
- 操作发生的日期和时间
- 执行操作的用户（操作者）的 SAML SSO 标识和 SCIM 标识
- 对于 Web UI 之外的操作，用户（操作者）如何进行身份验证
Site administrators can review the audit log for an instance, which contains a wider range of events including system administrative events. To access the instance-level audit log:
- 在 GitHub Enterprise Server 上的管理帐户中，在任一页面的右上角，单击“”。
- 如果你尚未在“站点管理员”页上，请在左上角单击“站点管理员”。
- In the left menu, click Audit log.
In addition to viewing your audit log, you can monitor activity in your enterprise in other ways, such as viewing push logs and managing global webhooks. For more information, see 探索企业中的用户活动. You can also use the audit log, and other tools, to monitor the actions taken in response to security alerts. For more information, see 审核安全警报.
How to use audit logs
As an enterprise owner or site administrator, you can interact with the audit log data for your enterprise in several ways:
- You can view the audit log for your enterprise. For more information, see 访问企业的审核日志.
- You can search the audit log for specific events. For more information, see 搜索企业的审核日志.
- You can identify all events that were performed by a specific access token. For more information, see 标识由访问令牌执行的审核日志事件.
- You can configure settings, such as the retention period for audit log events and whether Git events are included. For more information, see 为企业配置审核日志.
- You can stream audit and Git events data from GitHub to an external data management system. For more information, see 流式处理企业审核日志.
- You can forward audit and system logs, from your enterprise to an third-party hosted monitoring system. For more information, see 日志转发.
- You can use the Audit log API to view actions performed in your enterprise. For more information, see 在企业中使用审核日志 API.
For a full list of audit log actions that may appear in your enterprise audit log, see 企业的审核日志事件.