Latest Content

How to List Logs for a Vultr Account

Updated on 29 July, 2026

Retrieve account activity logs for a Vultr organization using the Vultr Console or API, with filters for date range, user, log level, and resource type.

Logs provide detailed records of user actions across your account, capturing events such as logins, Vultr Console interactions, and API requests. These logs offer valuable insight into account usage and help monitor security, track changes, and troubleshoot issues across your infrastructure. To access the List Logs API endpoint, you must either be the root user or have the appropriate ACL permission.

This guide explains how to retrieve account activity logs using the Vultr Console or the Vultr API.

  • Vultr Console
  • Vultr API

  1. Log in to the Vultr Console.

  2. Click the organization name in the top navigation bar.

  3. Click Manage Organization.

  4. Click Account Activity under the Logs section.

  5. Click the All dates dropdown to filter by a specific date range.

  6. Click the All users dropdown to filter by a specific user.

  7. Click the Selected levels dropdown and select the log levels to include, from Critical, Debug, Error, Info, and Warning.

  8. Click the All resource types dropdown to filter by a specific resource type, such as Instances or Kubernetes.

    The table updates to show Event time (UTC), User, Level, Message, Resource type, and Resource ID for each matching entry.

  9. (Optional) Click Export logs, select Export all logs or Export selected logs, and select CSV to download the filtered results.

Send a GET request to the List Logs endpoint to retrieve account activity. Replace START-TIME and END-TIME with a UTC timestamp range, and optionally filter using LOG-LEVEL, RESOURCE-TYPE, and RESOURCE-ID.

console 
$ curl "https://api.vultr.com/v2/logs?start_time=START-TIME&end_time=END-TIME&log_level=LOG-LEVEL&resource_type=RESOURCE-TYPE&resource_id=RESOURCE-ID" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

Replace:

  • START-TIME: UTC start of the time range, in yyyy-mm-ddThh:mm:ssZ format (e.g., 2026-06-01T00:00:00Z). Required if END-TIME is not set.
  • END-TIME: UTC end of the time range, in the same format. Required if START-TIME is not set. start_time and end_time cannot be more than 30 days and 1 hour apart.
  • LOG-LEVEL: One of info, debug, warning, error, or critical.
  • RESOURCE-TYPE: The resource type to filter by, such as instances, bare-metals, or kubernetes.
  • RESOURCE-ID: The UUID of a specific resource.

The response contains a logs array and a meta object. Each log entry includes resource_id, resource_type, log_level, message, timestamp, and a metadata object with user_id and ip_address at minimum. The meta object reports returned_count, unreturned_count, total_count, and a next_page_url for pagination when more than 5,000 records match the query.

Note
Vultr retains account activity logs for 30 days. The List Logs endpoint only returns logs from within that window, and requests with a start_time outside the last 30 days return no results. To retain logs beyond 30 days, create an audit logs subscription, which exports logs to object storage with a retention period you can configure and increase at any time.

Comments