Track activity in Axiom

This page explains how to track activity in your Axiom organization with the audit log.

The audit log allows you to track who did what and when within your Axiom organization.

Tracking activity in your Axiom organization with the audit log is useful for legal compliance reasons. For example, you can investigate the following:

Track who has accessed the Axiom platform.
Track organization access over time.
Track data access over time.

The audit log also make it easier to manage your Axiom organization. They allow you to do the following, among others:

Track changes made by your team to your observability posture.
Track monitoring performance and identify which monitors generate the most query load.
Monitor query costs and optimize expensive queries before they impact your budget.
Trace queries back to their source (monitors or direct queries) for debugging.

The audit log is available to all organizations. By default, you can query the audit log for the previous three days. You can purchase full access to the audit log as an add-on on the Axiom Cloud plan. For more information, see Manage add-ons.

Explore audit log

Go to the Query tab, and then click APL.
Query the axiom-audit dataset. For example, run the query ['axiom-audit'] to display the raw audit log data in a table.
Optional: Customize your query to filter or summarize the audit log. For more information, see Query data.
Click Run.

The action field specifies the type of activity that happened in your Axiom organization.

Export audit log

Run the query to display the audit log.
Click More > Download as JSON.

Give access to audit log

The audit log is only accessible to users with the Owner role. To allow other users to access the audit log:

Create a view that defines the parts of the audit log that you want the user to access.
Give the user access to the view.

Use cases and examples

The audit log captures rich context about queries run in your organization:

Query representation: Privacy-safe representations of queries help you understand query patterns without exposing sensitive data.
Query source: Track whether queries originated from monitors or direct queries.
Query cost: Monitor resource consumption in query units for cost optimization.
Storage bytes scanned: Understand data volumes processed by each query.

The examples below illustrate how the audit log can help you optimize performance, manage costs, and debug issues by tracing queries back to their origin.

Monitor high-cost queries

Identify queries that consume significant resources:

['axiom-audit']
| where action == 'runAPLQueryCost'
| where ['properties.query_cost_gbms'] > 1000

This query lists queries costing more than 1000 query units and helps you spot expensive queries and optimize them before they impact your budget.

Track monitor query load

Understanding which monitors generate the most query activity helps you optimize performance:

['axiom-audit']
| where action == 'runAPLQueryCost'
| where source == 'monitor'
| summarize 
    total_queries = count(),
    total_cost = sum(['properties.query_cost_gbms']),
    avg_cost = avg(['properties.query_cost_gbms'])
    by ['resource.id']
| sort by total_cost desc

Use this to identify monitors that might benefit from query optimization or frequency adjustments.

Analyze dataset usage

Find out which datasets are used the most:

['axiom-audit']
| where action == 'runAPLQuery'
| where isnotnull(['properties.datasets'])
| summarize 
    query_count = count()
    by ['properties.datasets'], bin(_time, 1d)
| sort by query_count desc

This query helps you understand how your team interacts with Axiom and identifies datasets that may need optimization.

Track ingest by dataset

Track how much data each dataset ingests over time:

['axiom-audit']
| where action == "usageCalculated"
| extend ingest_gb = tolong(['properties.hourlyIngestBytes']) / pow(1024, 3)
| summarize IngestGB = sum(ingest_gb) by bin_auto(_time), tostring(['properties.dataset'])
| sort by IngestGB desc

Determine total data ingest

Determine total data ingest across all datasets over time:

['axiom-audit']
| where action == "usageCalculated"
| extend ingest_gb = tolong(['properties.hourlyIngestBytes']) / pow(1024, 3)
| summarize TotalIngestGB = sum(ingest_gb) by bin_auto(_time)

Track query sources

See the distribution of queries across different sources:

['axiom-audit']
| where action == 'runAPLQuery'
| summarize query_count = count() by source
| sort by query_count desc

This helps you understand how your team interacts with Axiom and where queries originate.

List of trackable actions

The action field specifies the type of activity that happened in your Axiom organization. The actions that Audit logs allow you to track are the following:

aplDelete
createAnnotation
createAPIToken
createDashboard
createDataset
createEndpoint
createFlowConfiguration
createFlowDestination
createFlowReplay
createFlowStream
createGroup
createMapField
createMonitor
createNotifier
createOrg
createOrgStorage
createPersonalToken
createRole
createUser
createView
createVirtualField
deleteAnnotation
deleteAPIToken
deleteDashboard
deleteDataset
deleteEndpoint
deleteFlowConfiguration
deleteFlowDestination
deleteGroup
deleteMapField
deleteMonitor
deleteNotifier
deleteOrg
deletePersonalToken
deleteRepo
deleteRole
deleteSession
deleteShareLink
deleteView
downgradeOrg
downgradePlan
fieldLimitApproached
fieldLimitExceeded
getDashboard
getDatasetFields
getField
getSharedRepos
logout
logoutEverywhere
messageSent
notifierFailed
notifierTriggered
notifyCustomerIOIssues
postRepos
regenerateAPIToken
regeneratePersonalToken
removeRBAC
removeUserFromOrg
resolveMonitor
resolveMonitorAll
resumeFlowReplay
resumeFlowStream
rotateSharedAccessKeys
runAPLQuery
sendOrgDeletedEmails
sendOrgMonthlyIngestedExceededEmail
sendOrgMonthlyIngestedNearLimitEmail
sendUserDeletedEmail
sendWelcomeEmail
setEnableAI
shareRepo
stopFlowReplay
stopFlowStream
streamDataset
triggerNotifier
triggerNotifierWithID
trimDataset
unShareRepo
updateDashboard
updateDataset
updateDatasetSettings
updateEndpoint
updateField
updateFlowConfiguration
updateFlowDestination
updateGroup
updateMapFields
updateMonitor
updateNotifier
updateOrg
updatePersonalToken
updateRepo
updateRole
updateUser
updateUserSettings
updateView
updateVirtualField
upgradeOrg
upgradePlan
usageCalculated
useShareLink
vacuumDataset