Latest Content

How to Export Data from Audit Logs Object Storage

Updated on 29 July, 2026

Retrieve storage connection details from the Vultr Console and download exported audit log files from object storage using an S3-compatible command line client.

An audit logs subscription streams every account event to a dedicated bucket on Vultr Object Storage. Vultr writes the events as gzip-compressed log files, each covering a fixed time window, and retains them for the subscription's configured retention period.

This guide explains how to retrieve the storage connection details from the Vultr Console and download the exported log files using an S3-compatible client.

Retrieve the Storage Connection Details

The connection details identify the bucket holding your audit logs and the credentials required to read it.

  1. Log in to the Vultr Console.

  2. Click the organization name in the top navigation bar.

  3. Click Manage Organization.

  4. Click Audit Logs under the Logs section.

  5. Click click for details next to the Storage field.

    The Storage Details panel opens with the Hostname, Access Key, Secret Key, Bucket, and Prefix for your audit logs.

  6. Click the eye icon next to Access Key and Secret Key to reveal the full values, and click the copy icon next to each field to copy it.

  7. Click Download s3cfg File to download a preconfigured s3cmd configuration file for this bucket.

  8. Click Close.

Download and Read the Exported Log Files

s3cmd is an S3-compatible command line client you can use to list, download, and read the exported log files. Use the s3cfg file downloaded in the previous section to authenticate.

  1. List the log files in the bucket. Replace S3CFG-FILE with the path to the downloaded configuration file, BUCKET with the Bucket value, and PREFIX with the Prefix value.

    console 
    $ s3cmd -c S3CFG-FILE ls s3://BUCKET/PREFIX/

    The output lists the available log files, each named after the UTC start of its time window and ending in .log.gz.

  2. Download a specific log file. Replace LOG-FILE with the file name from the previous step.

    console 
    $ s3cmd -c S3CFG-FILE get s3://BUCKET/PREFIX/LOG-FILE .

  3. Open the downloaded file with zless, which pages through a gzip-compressed, newline-delimited log without extracting it first.

    console 
    $ zless LOG-FILE

    The output displays one JSON event per line, including the action, resource, actor, and timestamp for each entry.

Comments