Track Monitor Access and Configuration Changes
Overview
Audit Trail provides Datadog administrators visibility into who within the organization is using Datadog and how they are using it. This guide walks you through how you can see usage information for a specific monitor.
Get monitor ID
You need the monitor’s ID to get usage information for the monitor.
- Navigate to Monitors.
- Select your monitor.
- The monitor ID is in the monitor URL, located after
https://app.datadoghq.com/monitors/. For example, if the monitor URL is https://app.datadoghq.com/monitors/123456789, the monitor ID is 123456789. - Copy the monitor ID.
View monitor usage in Audit Trail
To see usage information for the monitor, use Audit Trail to search for all API GET requests for that monitor ID.
Navigate to Audit Trail.
In the search bar, enter the query: @http.status_code:200 @http.method:GET @http.url_details.path:/api/v1/monitor/<monitor_id>. Replace <monitor_id> with the monitor ID you copied earlier.
For example, if the monitor ID is 123456789, the search query should be @http.status_code:200 @http.method:GET @http.url_details.path:/api/v1/monitor/123456789. @http.status_code:200 narrows down the results to successful requests only.
Note: You can also use the facet panel on the left side of the page to formulate the search query.
Select the timeframe in the upper right side of the page to see the events for a specific time period.
You can configure the Group into fields section and select different visualization tools to break down and analyze the data based on your use case. For example, if you set the group by field to User Email and click Top List in the Visualize as section, you get a top list of users who accessed the monitor.
See Create a dashboard or a graph if you want to put this information into a dashboard or graph.
View recent monitor configuration changes
You can use event queries in Audit Trail to see a list of monitors that have had recent changes to their configurations.
Navigate to Audit Trail.
In the Search for field, paste a query to filter for the kind of changes you want to see. Here are some common examples:
| Audit event | Query in audit explorer |
|---|
| Monitor created | @evt.name:Monitor @asset.type:monitor @action:created |
| Monitor modified | @evt.name:Monitor @asset.type:monitor @action:modified |
| Monitor deleted | @evt.name:Monitor @asset.type:monitor @action:deleted |
| Monitor resolved | @evt.name:Monitor @asset.type:monitor @action:resolved |
Optionally, on the facet panel, use filters like Asset ID or Asset Name to narrow your results down to a specific monitor.
For each event in the table, you can see the email address of the user who performed the last change, and a summary of what happened.
To see additional information about a specific change, click the row in the table. Then, click the Inspect Changes (Diff) tab to see the changes that were made to the monitor’s configuration:
See Create a dashboard or a graph if you want to put this information into a dashboard or graph.
Further reading
Additional helpful documentation, links, and articles:
