--- title: "Manage Audit Logs" description: "Forward Container Registry audit logs to a syslog endpoint, choose which events are recorded, and stop writing audit logs to the database." date: 2026-08-28 lastmod: 2026-09-07 canonical: "https://container-registry.com/docs/2.16/administration-manual/other-system-settings/manage-audit-logs/" source: "https://container-registry.com/docs/2.16/administration-manual/other-system-settings/manage-audit-logs/index.md" harbor_version: "2.16" agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.16/administration-manual/other-system-settings/manage-audit-logs/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt." --- > Agent-friendly representation of . Site index: . # Manage Audit Logs *Forward Container Registry audit logs to a syslog endpoint, choose which events are recorded, and stop writing audit logs to the database.* Manage Audit Logs ================================= Audit logs record who acted on the registry and what they changed. This page shows you how to control that record end to end: choose which events are captured, forward them to a syslog endpoint, stop storing them in the database, and purge old entries on a schedule. ## Open the Audit Log settings These steps open the **Audit Log** configuration page, where you set recording, forwarding, and database storage. Purging old records happens on a separate page, covered in **Purge old audit logs** below. 1. Sign in as a system administrator. 2. Go to **Administration > Configuration**. 3. Open the **Audit Log** tab. ![](../img/audit-log-overview.png) The **Audit Log** tab sits next to **Authentication**, **Security**, and **System Settings**. In earlier releases these settings were on the **System Settings** tab. They now have their own tab. ## Choose which events are recorded The **Event Recording** matrix controls which events Container Registry records. Each row is a resource type. Each column is an action. Each cell is one event type, such as an artifact pull or a project deletion. The resource types are Users, Project Members, Robots, Artifacts, Projects, Configuration, and Repositories. The actions are the operations that apply to each resource, such as create, update, delete, pull, and login. ![](../img/audit_log.png) * A checked box records that event type. * Clear a box to stop recording that event type. By default every box is checked, so Container Registry records every event type. To change what is recorded: 1. Check or clear the boxes for the event types you want. 2. Click **SAVE**. ## Forward audit logs to a syslog endpoint Forward audit logs to an external syslog endpoint to collect them outside the registry. 1. In **Audit Log Forward Syslog Endpoint**, enter the endpoint. Use the `host:port` form, for example `harbor-log:10514`. 2. Click **SAVE**. Container Registry then sends each audit log entry to that endpoint. ## Stop writing audit logs to the database (optional) By default Container Registry writes every audit log entry to its database. If you forward audit logs to a syslog endpoint, you can stop writing them to the database as well. > **Warning:** Skip the database only when you forward audit logs to a syslog endpoint. If you skip the database without forwarding, the audit log is lost. 1. Set an endpoint in **Audit Log Forward Syslog Endpoint** first. **Skip Audit Log Database** stays disabled until you do. 2. Check **Skip Audit Log Database**. 3. Click **SAVE**. Container Registry then forwards audit logs to the endpoint only, and does not store them in its database. ## Purge old audit logs Recording settings decide what enters the audit log; they do not remove anything. To keep the database from growing without bound, purge old records on the **Log Rotation** page. ### Open Log Rotation * Expand **Administration** in the navigation pane; * Click **Clean Up**; * Open the **Log Rotation** tab. Log Rotation and Garbage Collection are the two tabs under Clean Up. Log Rotation purges audit-log records; Garbage Collection reclaims image storage (see [Garbage Collection](/docs/2.16/administration-manual/storage-management/garbage-collection-and-terminal-deletion-of-images/index.md)). ### Choose what to purge * **Keep records in** — enter how many days to keep. Records older than that are purged. * **Event types to purge** — check the record types a run removes: **Create artifact**, **Delete artifact**, **Pull artifact**, and **Other events**. Select at least one; **SAVE** stays disabled until you do. * Click **SAVE**. ![](../img/log-rotation.png) ### Run or schedule a purge * Use **PURGE NOW** to purge immediately, or set **Schedule to purge** to run it on a schedule. * Use **DRY RUN** first to see what a purge would remove without deleting anything. * The **Purge History** grid lists each run (Task ID, Trigger Type, Dry Run, Status, Creation Time, Update Time, Logs); open a run's Logs to see what it removed, or use **STOP** to halt a run in progress. ## Verify * Reopen the **Audit Log** tab and confirm each field holds the value you set. * If you forward to a syslog endpoint, perform an action such as pushing an artifact, then confirm the entry arrives at the endpoint. * Reopen the **Log Rotation** page and confirm the **Purge History** grid shows your run. To read the recorded audit logs in the web console, see [Working With Logs](/docs/2.16/user-manual/working-with-logs/index.md).