Custom Yandex Audit Trails metrics

Written by

You can track the status of trails using Yandex Monitoring, which is a service for collecting and storing Yandex.Cloud resource metrics.

Audit Trails metrics

Metric name	Description	Labels
`trail.status`	Current trail status. You can use the metric to create an alert for a trail transitioning to an inactive state	trail, status
`trail.processed_events_count`	Frequency of events received for processing from audit log collection scope	trail, event_type, event_source
`trail.unauthorized_events_count`	Frequency of failed authorization events. You can use the metric to create an alert for attempts of unauthorized access to resources	trail, event_type, event_source
`trail.delivered_events_count`	Frequency of events delivered to the destination object. You can use the metric to create an alert that the upload of audit logs to the destination object is suspended because there is no free space in a bucket, for instance, or because a required role has been revoked from a service account	trail, event_type, event_source, destination_type
`quota.trails_count.limit`	Current trail quota per cloud	—
`quota.trails_count.usage`	Current usage of the trail quota per cloud. You can use the metric to create an alert that the quota is about to be reached	—