---
title: "oz0 audit"
description: "Read the audit log, newest first in its chain's order: one tenant's entries by sequence number, several tenants' by the time the database recorded them."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/audit"
---
# oz0 audit

> Read the audit log, newest first in its chain's order: one tenant's entries by sequence number, several tenants' by the time the database recorded them.

For: Operators and developers looking up a command.

Read the audit log, newest first in its chain's order: one tenant's entries by sequence number, several tenants' by the time the database recorded them. AT is when an entry happened by the clock of whoever wrote it, and --since and --until keep the entries recorded in that time, as audit export does.

Each entry of a job tree names its starter (the person, key, routine, webhook or event source that started the tree's root job), the agent's version, the plugin and the tool where they apply.

--starter finds the entries of the job trees one principal started (user:\<name>, apikey:\<id>, routine:\<name>, ...). It is an investigation tool, not a statistic: it takes --tenant and a --reason, the search itself is recorded in the audit log (audit.search.starter, with who searched, for whom and why), and it returns entries, never counts.

## Usage

```bash
oz0 audit [flags]
oz0 audit [command]
```

## Subcommands

- [`export`](https://docs.oz0.ai/reference/cli/oz0/audit/export)
- [`key`](https://docs.oz0.ai/reference/cli/oz0/audit/key)
- [`verify`](https://docs.oz0.ai/reference/cli/oz0/audit/verify)

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --action
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      only this action, or every action under a prefix that ends in a dot, such as node.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --all
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      read every page, not one
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --limit
      </code>
    </td>
    
    <td>
      int32
    </td>
    
    <td>
      
    </td>
    
    <td>
      at most this many rows a page (the server's 25 when 0, at most 100)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --page-token
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      go on after the page before: the token it printed
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why you search by starter, recorded in the audit log (at least 10 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --since
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      only entries recorded at or after this time (RFC 3339, or a duration ago such as 2h)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --starter
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      only the entries of job trees this principal started, such as user:ada (takes --tenant and --reason)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --target
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      only entries about this target, such as a node ID or tenant/plugin
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      only this tenant's entries
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --until
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      only entries recorded before this time (RFC 3339, or a duration ago such as 30m)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.