Audit Log Reference

Private Preview

On Zilliz Cloud, audit logs have the following syntax:

{
    "date": "<timestamp>",
    "action": "<action_type>",
    "cluster_id": "<unique_cluster_identifier>",
    "database": "<database_name>",
    "interface": "<interface_type>",
    "log_type": "<log_type>",
    "params": {
        "<key1>": "<value1>",
        "<key2>": "<value2>",
      ...
    },
    "result": <result_code>,
    "status": "<action_status>",
    "time": <timestamp>,
    "trace_id": "<unique_trace_identifier>",
    "user": "<user_identifier>"
}

Field	Type	Description
date	String (ISO 8601 format)	The timestamp when the action occurred, in UTC (e.g., "2025-01-21T08:38:39.494527Z").
action	String	The action performed (e.g., "DescribeCollection"). For a list of actions available, refer to List of actions.
cluster_id	String	Unique identifier for the cluster where the action occurred (e.g. "in01-b5a7e190615xxxf").
database	String	The name of the database involved in the action (e.g., "default").
interface	string	The interface through which the action is performed (e.g., "Grpc", "Restful").
log_type	String	The type of log entry (e.g., "AUDIT").
params	Object (key-value pairs)	Additional parameters related to the action. This can include things like collection, consistency_level, etc.
result	Integer	Result code or status code (e.g., 0 for success, other codes may indicate errors). Unavailable when the status is Receive.
status	String	The status of the action being logged (e.g., Receive, Success, Failed). Receive: The action has been received by the system but is not completed. Success: The action has been successfully completed without any issues. Failed: The action failed.
time	Integer (epoch time, milliseconds)	Timestamp in milliseconds since 1970 (epoch time).
trace_id	String	Unique identifier for tracing the request across systems. This helps link logs together.
user	String	The user who performed the action. Possible values: zcloud_dms: The action was performed through the Zilliz Cloud console. zcloud_apikey_admin: The action was performed via the RESTful API. Note: Actions performed via API keys are logged as zcloud_apikey_admin, without identifying the specific user. Support for logging individual API keys will be added in a later release.

List of actions

The following tables summarize actions on the data plane that can be logged for auditing.

Connection

action	Description
Connect	Establish a connection

Database

action	Description
ListDatabases	View all databases in the current instance
DescribeDatabase	View the details of a database
CreateDatabase	Create a database
DropDatabase	Drop a database
AlterDatabase	Modify the properties of a database

Collection

action	Description
GetLoadState	Check the load status of a collection
GetLoadingProgress	Check the loading progress of a collection
DescribeCollection	View the details of a collection
CreateCollection	Create a collection
HasCollection	Check if a collection exists in the database
DropCollection	Drop a collection
LoadCollection	Load a collection
AlterCollection	Alter the schema or configuration of a collection
ShowCollections	View all collections with collection privileges
RenameCollection	Rename a collection
ReleaseCollection	Release a collection
GetCollectionStatistics	Obtain the statistics of a collection (eg. The number of entities in a collection)
Flush	Persist all entities in a collection to a sealed segment. Any entity inserted after the flush operation will be stored in a new segment.
GetFlushState	Check the status of the collection flush operation
CreateAlias	Create an alias for a collection
DescribeAlias	Describe the alias of a collection
AlterAlias	Change the alias associated with a collection
ListAliases	View all aliases of a collection
DropAlias	Drop the alias of a collection
GetReplicas	Get the replicas of a collection

Partition

action	Description
CreatePartition	Create a partition
HasPartition	Check whether a partition exists
LoadPartitions	Load one or more partitions
ShowPartitions	View all partitions in a collection
DropPartition	Drop a partition
ReleasePartitions	Release one or more partitions
GetPartitionStatistics	Obtain the statistics of a partition

Index

action	Description
CreateIndex	Create an index
DescribeIndex	View the progress of index building for a collection
AlterIndex	Update the configuration or parameters of an existing index
GetIndexState	Update the configuration or parameters of an existing index
GetIndexStatistics	Retrieve the current state of an index (e.g., building, built, or failed)
GetIndexBuildProgress	Obtain detailed statistics about an index, such as memory usage or indexed entity count
DropIndex	Retrieve detailed index data for a specific segment in a collection

Entity

action	Description
Insert	Insert entities
Query	Conduct a query
Search	Conduct a search
HybridSearch	Conduct a hybrid search
Delete	Delete entities
Upsert	Upsert entities

RBAC

action	Description
SelectRole	Retrieve the list of roles available in the current instance
CreateRole	Define a new role for managing user permissions
DropRole	Drop a role
OperateUserRole	Assign a role to a user or remove a role from a user
ListPrivilegeGroups	View all privilege groups in the current instance
OperatePrivilegeV2	Add or remove specific privileges from a privilege group
SelectGrant	Retrieve a list of all privilege grants assigned to a specific role or user
CreateCredential	Create a new credential (e.g., API key or token) for accessing the system
UpdateCredential	Update the properties or permissions of an existing credential
DeleteCredential	Remove a credential from the system
ListCredUsers	Retrieve a list of all users associated with specific credentials

Others

action	Description
Authorize	Logged only when authorization fails, with the status recorded as Refused.