---
name: codeengine-at-events
title: Auditing events for Code Engine
description: You can view, manage, and audit user-initiated activities made in your IBM Cloud® Code Engine service instance by using the IBM Cloud Logs service.
last-updated: 2025-06-11
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/codeengine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Auditing events for Code Engine
{: #at_events}

You can view, manage, and audit user-initiated activities made in your IBM Cloud® Code Engine service instance by using the IBM Cloud Logs service.
{: shortdesc}

IBM Cloud Logs records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to follow regulatory audit requirements. You can also be alerted about actions as they happen. The events that are collected follow the Cloud Auditing Data Federation (CADF) standard. For more information, see the [Getting Started with IBM Cloud Logs](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-getting-started&format=markdown).

You can also start auditing from your Code Engine dashboard by selecting **Add auditing**.
{: tip}

## List of events from IBM Cloud console and CLI actions
{: #list-events-cli-console}

The following events are generated when an initiator interacts with the IBM Cloud Code Engine console and CLI or with the **`kubectl`** and **`kn`** commands. These events are sent to IBM Cloud Logs.
{: shortdesc}

### Project events
{: #project-events}

These actions generate project events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.project.create` | Create a project. |
| `codeengine.project.read` | Get information about or list projects. |
| `codeengine.project.update` | Update a project. |
| `codeengine.project.delete` | Delete a project. |
| `codeengine.projectconfig.read` | Get a project `kubeconfig` file. |
{: caption="Actions that generate project events" caption-side="bottom"}

### Application events
{: #app-events}

These actions generate application events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.application.create` | Create an application in a project. |
| `codeengine.application.read` | Get information about an application. |
| `codeengine.application.list` | List applications. |
| `codeengine.application.update` | Update an application. |
| `codeengine.application.delete` | Delete one or more applications. |
{: caption="Actions that generate application events" caption-side="bottom"}

### Configmap events
{: #configmap-events}

These actions generate configmap events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.configmap.create` | Create a configmap in a project. |
| `codeengine.configmap.read` | Get information about a configmap. |
| `codeengine.configmap.list` | List configmaps. |
| `codeengine.configmap.update` | Update a configmap. |
| `codeengine.configmap.delete` | Delete one or more configmaps. |
{: caption="Actions that generate configmap events" caption-side="bottom"}

### Secret events
{: #secret-events}

These actions generate secret events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.secret.create` | Create a secret in a project. |
| `codeengine.secret.read` | Get information about a secret. |
| `codeengine.secret.list` | List secrets. |
| `codeengine.secret.update` | Update a secret. |
| `codeengine.secret.delete` | Delete one or more secrets. |
{: caption="Actions that generate secret events" caption-side="bottom"}

### Build and build run events
{: #build-events}

These actions generate build and build run events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.build.create` | Create a build in a project. |
| `codeengine.build.read` | Get information about a build. |
| `codeengine.build.list` | List builds. |
| `codeengine.build.update` | Update a build. |
| `codeengine.build.delete` | Delete one or more builds. |
| `codeengine.buildrun.create` | Submit a build run in a project. |
| `codeengine.buildrun.read` | Get information about a build run. |
| `codeengine.buildrun.list` | List build runs. |
| `codeengine.buildrun.delete` | Delete one or more build runs. |
{: caption="Actions that generate build and build run events" caption-side="bottom"}

### Job and job run events
{: #job-events}

These actions generate job and job run events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.job.create` | Create a job in a project. |
| `codeengine.job.read` | Get information about a job. |
| `codeengine.job.list` | List jobs. |
| `codeengine.job.update` | Update a job. |
| `codeengine.job.delete` | Delete one or more jobs. |
| `codeengine.jobrun.create` | Submit a job run. |
| `codeengine.jobrun.read` | Get information about a job run. |
| `codeengine.jobrun.list` | List job runs. |
| `codeengine.jobrun.delete` | Delete one or more job runs. |
{: caption="Actions that generate job and job run events" caption-side="bottom"}

### Subscription events
{: #subscription-events}

These actions generate subscription events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.subscription.create` | Create subscription in a project. |
| `codeengine.subscription.read` | Get information about a subscription. |
| `codeengine.subscription.list` | List subscriptions. |
| `codeengine.subscription.update` | Update a subscription. |
| `codeengine.subscription.delete` | Delete one or more subscriptions. |
{: caption="Actions that generate subscription events" caption-side="bottom"}

## List of events from **`kubectl`** and **`kn`** commands
{: #kubect1-events}

The following events are generated when an initiator interacts with the **`kubectl`** and **`kn`** commands. These events are sent to IBM Cloud Logs.

### Pod events
{: #kubect1-pod-events}

These actions generate pod events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.pods.create` | Create a pod in a project. |
| `codeengine.pods.read` | Get information about a pod. |
| `codeengine.pods.list` | List pods. |
| `codeengine.pods.update` | Update a pod. |
| `codeengine.pods.delete` | Delete a pod. |
{: caption="Actions that generate pod events" caption-side="bottom"}

### Service account events
{: #kubect1-serviceaccount-events}

These actions generate service account events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.serviceaccounts.read` | Get information about a service account. |
| `codeengine.serviceaccounts.list` | List service accounts. |
{: caption="Actions that generate service account events" caption-side="bottom"}

### Event events
{: #kubect1-event-events}

These actions generate event-type events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.events.read` | Get information about an event. |
| `codeengine.events.list` | List events. |
{: caption="Actions that generate event-type events" caption-side="bottom"}

### Resource quota events
{: #kubect1-resourcequote-events}

These actions generate resource quota events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.resourcequotas.read` | Get information about a resource quota. |
| `codeengine.resourcequotas.list` | List resource quotas. |
{: caption="Actions that generate resource quota events" caption-side="bottom"}

### Limit range events
{: #kubect1-limitrange-events}

These actions generate limit range events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.limitranges.read` | Get information about a limit range. |
| `codeengine.limitranges.list` | List limit ranges. |
{: caption="Actions that generate limit range events" caption-side="bottom"}

### Deployment events
{: #kubect1-deployment-events}

These actions generate deployment events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.deployments.read` | Get information about a deployment. |
| `codeengine.deployments.list` | List deployments. |
{: caption="Actions that generate deployment events" caption-side="bottom"}

### Service binding events
{: #kubect1-servicebinding-events}

These actions generate service bind events.

| Action             | Description      |
|--------------------|------------------|
| `codeengine.servicebindings.create` | Create a service binding in a project. |
| `codeengine.servicebindings.read` | Get information about a service binding. |
| `codeengine.servicebindings.list` | List service bindings. |
| `codeengine.servicebindings.update` | Update a service binding. |
| `codeengine.servicebindings.delete` | Delete a service binding. |
{: caption="Actions that generate service bind events" caption-side="bottom"}

Note:
- The update event does not include the original value; it includes only the new value that is provided in request body. To find the original value, you can run read action before you run the update action.
- The `requestData` field includes request body and verb of action.
- The `responseData` field includes response body of action.
- For some actions, for example `codeengine.pods.list` or `codeengine.pods.get` actions, the event length might exceed 16 K. If this event length occurs,  the `responseData` field is set to `Information about the action is not included for performance and size reasons.`

## Viewing events
{: #view}

IBM Cloud Code Engine sends audit logs to the [IBM Cloud Logs](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-getting-started&format=markdown) service in the same region as the IBM Cloud Code Engine project. For example, audit logs in an IBM Cloud Code Engine project in `us-south` are sent to a logging instance in `us-south`. For more information about setting up IBM Cloud Logs, see [Provisioning an instance](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-instance-provision&interface=ui&format=markdown).

## Analyzing events
{: #at_events_analyze}

After you view events that are captured by IBM Cloud Logs, you can then analyze the events.
{: shortdesc}

Identifying the Code Engine project that generates the event
:    To identify the project for which the event was generated, look at the `target.id` field. You can use this field to filter events in Log Analysis, for example, showing events for only a specific project.
:    You can use the CLI to find details about your [project](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project&format=markdown).

Getting the unique ID of a request
:    Each action that you perform on a Code Engine project resource has a unique ID.
:    To find the unique ID of a request, look at the `correlationId` value that is set in the `correlationId` field.

Getting information for failures
:    All events that are issued for failed actions display `failure` in the `outcome` field, and in addition provide more details as part of the `reason` field. Note that the `reason.reasonForFailure` field might be especially helpful, as it contains details of the failure.

Custom views
:    For more information about generating custom views by using event fields, see [Managing custom views in IBM Cloud Logs](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-custom_views&interface=ui&format=markdown).