---
title: "Configure Audit Logging"
description: "Forward Container Registry audit logs to a syslog endpoint, choose which events are recorded, and stop writing audit logs to the database."
date: 2026-08-28
lastmod: 2026-08-31
canonical: "https://container-registry.com/docs/2.16/administration-manual/other-system-settings/configure-audit-logging/"
source: "https://container-registry.com/docs/2.16/administration-manual/other-system-settings/configure-audit-logging/index.md"
harbor_version: "2.16"
agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.16/administration-manual/other-system-settings/configure-audit-logging/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/docs/2.16/administration-manual/other-system-settings/configure-audit-logging/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Configure Audit Logging

*Forward Container Registry audit logs to a syslog endpoint, choose which events are recorded, and stop writing audit logs to the database.*


Configure Audit Logging
=================================

Audit logs record who acted on the registry and what they changed. This page shows you how to choose which events are recorded, forward those logs to a syslog endpoint, and stop writing them to the database. You set all three on the **Audit Log** configuration page.

## Open the Audit Log settings

1. Sign in as a system administrator.
2. Go to **Administration > Configuration**.
3. Open the **Audit Log** tab.

The **Audit Log** tab sits next to **Authentication**, **Security**, and **System Settings**. In earlier releases these settings were on the **System Settings** tab. They now have their own tab.

## Choose which events are recorded

The **Event Recording** matrix controls which events Container Registry records. Each row is a resource type. Each column is an action. Each cell is one event type, such as an artifact pull or a project deletion.

The resource types are Users, Project Members, Robots, Artifacts, Projects, Configuration, and Repositories. The actions are the operations that apply to each resource, such as create, update, delete, pull, and login.

![](../img/audit_log.png)

* A checked box records that event type.
* Clear a box to stop recording that event type.

By default every box is checked, so Container Registry records every event type.

To change what is recorded:

1. Check or clear the boxes for the event types you want.
2. Click **SAVE**.

## Forward audit logs to a syslog endpoint

Forward audit logs to an external syslog endpoint to collect them outside the registry.

1. In **Audit Log Forward Syslog Endpoint**, enter the endpoint. Use the `host:port` form, for example `harbor-log:10514`.
2. Click **SAVE**.

Container Registry then sends each audit log entry to that endpoint.

## Stop writing audit logs to the database (optional)

By default Container Registry writes every audit log entry to its database. If you forward audit logs to a syslog endpoint, you can stop writing them to the database as well.


> **Warning:** Skip the database only when you forward audit logs to a syslog endpoint. If you skip the database without forwarding, the audit log is lost.


1. Set an endpoint in **Audit Log Forward Syslog Endpoint** first. **Skip Audit Log Database** stays disabled until you do.
2. Check **Skip Audit Log Database**.
3. Click **SAVE**.

Container Registry then forwards audit logs to the endpoint only, and does not store them in its database.

## Verify

* Reopen the **Audit Log** tab and confirm each field holds the value you set.
* If you forward to a syslog endpoint, perform an action such as pushing an artifact, then confirm the entry arrives at the endpoint.

To read the recorded audit logs in the web console, see [Working With Logs](/docs/2.16/user-manual/working-with-logs/index.md).