---
title: How to access the Kubernetes audit logs
description: This page explains how to access the audit logs of your Kubernetes cluster
tags: kubernetes kubernetes-kapsule kapsule kosmos cluster audit logs
dates:
  validation: 2026-01-21
  posted: 2024-01-24
---
import Requirements from '@macros/iam/requirements.mdx'
import CockpitIamPermissions from '@macros/cockpit/iam-permissions-cockpit.mdx'


Kubernetes Kapsule and Kosmos control plane metrics and logs are integrated into Cockpit, providing you with a centralized hub for monitoring the control plane, nodes, managed resources, and cluster system applications.

While this initial integration empowers you with the autonomy to troubleshoot issues promptly, we have taken the next step by extending the functionality, now Kubernetes audit records are also exported into Cockpit.

Kubernetes audit logs provide detailed insights into user-generated activities, actions initiated by applications using the Kubernetes API, and operations performed by the control plane.

Auditing allows cluster administrators to answer the following questions:

- What happened?
- When did the event occur?
- Who initiated the action?
- On which resource did it take place?
- Where was the occurrence observed?
- From which source was the action initiated?
- To which destination was it directed?

Audit logging in Kubernetes clusters is enabled by default for clusters with dedicated control planes. Use audit logging to keep a chronological record of calls made to the Kubernetes API server, investigate suspicious API requests, collect statistics, or create monitoring alerts for unwanted API calls.

All logs are centralized in [Cockpit](/cockpit/quickstart/).

<Message type="tip">
    Monitoring calls to the `kube-apiserver` is a matter of security compliance and perhaps a hard requirement for some of the certifications you are keen to obtain.
</Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- Created a [Kubernetes Kapsule or Kosmos cluster](/kubernetes/how-to/create-cluster/)
- A cluster that uses a [dedicated control plane](https://www.scaleway.com/en/kubernetes-dedicated-control-plane/)

## How to enable audit logging for your clusters

Audit logging is enabled automatically for all new clusters using a [dedicated control plane](https://www.scaleway.com/en/kubernetes-dedicated-control-plane/).

If you upgrade your cluster from a mutualized control plane to a dedicated one, audit logging will be enabled automatically for your cluster.

You can enable audit logging for all clusters using a [dedicated control plane](https://www.scaleway.com/en/kubernetes-dedicated-control-plane/).
Audit logging is enabled by default for all new clusters. If your cluster predates the introduction of this feature, follow the steps below to activate audit logs via your Scaleway console.

<Message type="tip">
    Audit logs are automatically enabled by default for all new clusters using dedicated control planes.
</Message>

1. In the **Security and Compliance** section of your Kubernetes cluster's **Settings** tab, enable the **Audit logs** feature.
2. [Access Grafana](/cockpit/how-to/access-grafana-and-managed-dashboards/) to view the logs on the **Kubernetes Cluster Audit Logs** dashboard in Cockpit and the **Explore** section of Cockpit/Grafana.

<Message type="tip">
    If you are not sure whether audit logs for your cluster are enabled, you can verify the status of the feature from the clusters **Security** tab at any time.
</Message>

## How to disable audit logging

<Message type="important">
  The audit log feature is automatically disabled when downgrading your cluster from a dedicated to a mutualized control plane. This means no further audit logs will be stored in Cockpit once downgraded.
</Message>

## How to access cluster audit logs for clusters having a dedicated control plane.

You can access your clusters audit logs in [Cockpit](/cockpit/), Scaleway's monitoring solution.

<Message type="tip">
    Audit logs are automatically enabled by default for all clusters using dedicated control planes.
</Message>

[Access Grafana](/cockpit/how-to/access-grafana-and-managed-dashboards/) to view the logs on the **Kubernetes Cluster Audit Logs** dashboard in Cockpit and the **Explore** section of Cockpit/Grafana.

<CockpitIamPermissions />

## How to use audit logging with mutualized control planes

Audit logging is only available for clusters using a [dedicated control plane](https://www.scaleway.com/en/kubernetes-dedicated-control-plane/).

Note that downgrading your cluster from a dedicated to a mutualized control plane will **automatically disable audit logging**, ceasing the storage of any further audit logs in Cockpit.

<Message type="note">
  Audit logging results in increased memory consumption for the API server, as it needs to store additional information for each audited request.
</Message>

<Message type="important">
  Be aware that audit logging is a feature specifically designed for clusters using a dedicated control plane. If you decide to downgrade to a mutualized control plane, the feature will be automatically deactivated for the cluster.
</Message>

## Kubernetes audit policy

The Kubernetes audit policy defines the selection of log entries exported by the Kubernetes API server.

You can examine the [Kubernetes audit policy](https://github.com/scaleway/kubernetes-gists/blob/main/audit/policy.yaml) file, which contains a list of rules, giving you complete visibility into our API server configuration and the chosen request treatments or exclusions.