Audit log streaming

FEATURE AVAILABILITY

Audit log streaming is only available for some Workato plans. Contact your Customer Success representative to learn more about enabling this feature in your account.

The Workato platform automatically stores all Activity audit logs for a period of one year from the date of each event. This ensures you have ample time to review and analyze your activity logs for security and operational insights.

In addition to retaining audit logs in the Workato platform itself, you can also choose to stream these logs to a specified destination.

When you enable audit log streaming, Workato stores the job history of all your recipes, as well as login and user activity, in an Amazon S3 bucket or any REST endpoint. You can use any log service provider (such as Sumo Logic (opens new window), Datadog (opens new window), or Splunk (opens new window)).

Workato creates a JSON file for each event. The file size varies from 1 KB to 1 MB based on the details that are present in the logs.

Workato retains your audit logs for the designated retention period for your account even if audit log streaming is not enabled. This retention is part of our commitment to data security and operational transparency.

MASKED DATA

You can enable data masking to prevent Workato from logging or streaming the input or output of any trigger or action. Workato generates a placeholder step when data masking is enabled. Refer to our data masking documentation for more information.

Example job details log with masked data

The following code provides an example of how masked data appears in a job details log. The example code is truncated to provide a concise example. Refer to Activity audit log streaming samples for a complete example of a job details log.

        "lines": [
            {
                "input": {"data": "masked"},
                "output": {"data": "masked"},
                "adapter_name": "timer",
                "adapter_operation": "trigger_event",
                "line_stat": {
                    "details": [
                        {
                            "name": "execution_time",
                            "average": 0.002,
                            "total": 0.002,
                            "min": 0.002,
                            "max": 0.002,
                            "count": 1
                        }
                    ],
                    "total": 0.002
                },
                "recipe_line_number": 1,
                "mask_data": true
            }

Which audit log streaming destinations does Workato support?

Workato supports the following streaming destinations:

• Amazon S3
• Azure Monitor
• Azure Blob Storage
• Cloud-based logging service, including Google Cloud Storage Buckets

Audit log size

Log file size varies from 1 KB to 1 MB based on the details that are present in the logs.

The file size limit for logs is 40 MB.

When streaming full job details, the system does not send step-specific log lines if the overall file size exceeds 40 MB. If a file exceeds 40 MB, the system still sends contextual job information, such as user_id, recipe_id, and time_executed. However, the “lines” column displays the default text, Log lines exceed size limit.

Set up audit log streaming

1

Navigate to Workspace admin > Settings > Log streaming (opens new window) and select Set up audit log streaming:

2

Select the audit log destination.

3

Configure the streaming connection and options.

4

Choose the events to include in your audit log stream.

Consult Audit log streaming types for more information about events.

5

Optional. Customize a log message if required.

6

Select Save.