Coder logo

Audit

Coder maintains records of all user actions on system resources for auditing purposes.

Any user who is a Site Manager or an Auditor can log into Coder, go to Manage > Audit, and view the Audit Logs.

By default, this page displays a chronological list of all actions taken on the system.

You can filter the logs displayed using the search filters available at the top:

  • Resource Type: The resource on which the action is taken (e.g., image, workspace, user)
  • Action: The action that the user took against a resource (e.g., read, write, create)
  • Resource Target: The friendly name for the resource (e.g., the user with the email address dev@coder.com)
  • User: The user who performs the action

Actions

The audit logs capture information about the following actions (those who export Coder logs will see this information under message.fields.audit_log.action):

When reviewing Coder's audit logs, specifically, you will see the following actions included:

  • auto_off: Coder automatically turned off a workspace due to inactivity
  • auto_start: Coder automatically turned on a workspace at the time preset by its owner
  • connect: a user connected to an existing workspace via a local VS Code instance, a JetBrains IDE via JetBrains Gateway, a local terminal ssh connection, or a local terminal connection via the Coder CLI's coder ssh command
  • cordon: a workspace provider became unavailable for new workspace creation requests
  • create: the user created a Coder entity (e.g., dev URL, image/image tag, workspace, etc.)
  • delete: a user deleted a Coder entity (e.g., workspace or image)
  • enqueue: a user added a new job to the queue (e.g., workspace build, user deletion, workspace deletion)
  • login: a user logs in via basic authentication or OIDC, with Coder exchanging a token as a result
  • open: a user opened a workspace using the Code Web IDE through the browser (please note that this action is not yet logged for JetBrains IDEs)
  • ssh: a user opened a web terminal to access Coder
  • stop: a user manually stopped a workspace
  • uncordon: a workspace provider became available for new workspace creation requests
  • view: the Coder CLI used a secret
  • write: the user made a change to a Coder entity (e.g., workspace, user, resource pool, etc.)

Admin logged events

With the exception of a few, logged events made by Admin panel changes will output the changed field(s) and the new, corresponding value. Below is the expected (example) output for each Admin panel change.

The Admin fields not documented below currently do not output a field/diff.

Infrastructure

Admin SettingActionTargetFieldDiff
Access URLWriteinfrastructureaccess URLcoder.com
GPU VendorWriteinfrastructuregpu vendoramd/nvidia/none
Enable container-based virtual machinesWriteinfrastructureenable container vmstrue/false
Enable cachingWriteinfrastructureenabled cached container vmstrue/false
Enable auto loading of shiftfs kernel moduleWriteinfrastructureenable load shiftfstrue/false
Default to container-based virtual machinesWriteinfrastructuredefault container vmstrue/false
Enable self-contained workspace buildsWritefeaturescoder agent pull assetsenabled/disabled
Enable workspace process loggingWritefeaturesexectraceenabled/disabled
Enable TUN deviceWritefeaturesfuse deviceenabled/disabled
Enable FUSE deviceWritefeaturestun deviceenabled/disabled
Enable default registryWriteinfrastructuredefault registry enabledtrue/false
Enable ECR IAM role authenticationWritefeaturesecr auth irsaenabled/disabled
Enable AAD authentication for ACRWritefeaturesazure auth aadenabled/disabled
Enable fallback shell support for K8sWritefeatures
Extension marketplace typeWrite*ext marketplace typepublic/custom
Dev URL access permissionsWritedevurl accesspublic/org/authed/true/false
Enable memory overprovisioningWriteinfrastructurememory overprovisioning enabledtrue/false

Git OAuth

Admin SettingActionTargetFieldDiff
Client IDWriteoauth configsclient id0fb2...7a4a
Client SecretWriteoauth configsclient secret******
DescriptionWriteoauth configsdescriptionexample
NameWriteoauth configsnameGitHub
ProviderWriteoauth configsservice typegithub/gitlab
URLWriteoauth configsURL hosthost.com

Appearance

Admin SettingActionTargetFieldDiff
System BannerWritesystem bannerenabledtrue/false
Background colorWritesystem bannercolor bg#9A4967
FooterWritesystem bannertext footerUNCLASSIFIED
HeaderWritesystem bannertext headerUNCLASSIFIED
Service BannerWriteappearancesvc banner enabledtrue/false
Background colorWriteappearancesvc banner color bg#18382D
MessageWriteappearancesvc banner bodyMaintenance 9:01PM
Terms of ServiceWriteappearancetos bodyAccept Terms & Conditions
Text fieldWriteappearancetos enabledtrue/false

Telemetry

Admin SettingActionTargetFieldDiff
Send crash reportsWritetelemetrycrash reports enabledtrue/false
Send usage telemetryWritetelemetryenhanced telemetry enabledtrue/false
Send enhanced usage telemetryWritetelemetrytelemetry enabledtrue/false

Templates

The template policy dropdown will provide a unique commit/hash for the uploaded file. If file is uploaded from disk, then file path/git ref will be local.

Admin SettingActionTargetFieldDiff
Enable workspace templatesWriteinfrastructureenable workspaces as codetrue/false
Template policyWritelocalcommit/file hash/filepath/git ref/From0000...0000/ed19...843b/local/local/User