## 7.6.3.3 Auditing and Logging Information in Kyma
Kyma runtime collects audit and application logs.
## Audit Logs
Audit logs are records that provide evidence of events, actions, or operations. The audit log records the following data:
- Security and system events that include administrative activities, potential threats, and evidence in the case of a breach.
- Changes introduced to the system, applications, and components.
Kyma runtime collects audit logs for configuration changes to the runtime setup itself and Kubernetes resources managed by the Kubernetes API server of the runtime. Usually, those logs contain the user account (technical account or email address) and the client IP address of the subject who triggered the changes. No other personal data is stored in the audit logs. The logs store the data for 90 days. If you want to store any other personal data, be cautious and bear in mind the recommendations provided in Data Protection and Privacy [page 3273].
## Retrieving Audit Log Entries
As a user, you don't have direct access to the audit logs. If you want to get information stored in the audit log system, open a support ticket .
## Events Written in Audit Logs
Here you can find a list of the security events that are logged by SAP BTP , Kyma runtime.
## Events Written in Audit Logs
| Event grouping                                           | What events are logged                                             | Additional information                                                                                                                                                                                                                                                                                                                                                                                               |
|----------------------------------------------------------|--------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Secrets, ConfigMaps, and TokenRe- views                  | CREATE, UPDATE, PATCH, and DELETE operations on the metadata level | The payload is not logged. Resources: • "secrets" • "configmaps" • "tokenreviews"                                                                                                                                                                                                                                                                                                                                    |
| All standard Kubernetes resources in core and extensions | CREATE, UPDATE, PATCH, and DELETE operations on the request level  | Resource groups: • "" #core • "admissionregistration.k8s.io" • "apiextensions.k8s.io" • "apiregistration.k8s.io" • "apps" • "authentication.k8s.io" • "authorization.k8s.io" • "autoscaling" • "batch" • "certificates.k8s.io" • "coordination.k8s.io" • "extensions" • "metrics.k8s.io" • "networking.k8s.io" • "policy" • "rbac.authorization.k8s.io" • "scheduling.k8s.io" • "settings.k8s.io" • "storage.k8s.io" |
| All Kyma resources                                       | CREATE, UPDATE, PATCH, and DELETE operations on the request level  | Resource groups: • "applicationconnector.kyma- project.io" • "compass.kyma-project.io" • "eventing.kyma-project.io" • "gateway.kyma-project.io" • "serverless.kyma-project.io" • "telemetry.kyma-project.io" • "operator.kyma-project.io"                                                                                                                                                                            |
| Event grouping                     | What events are logged                                            | Additional information                                                                                                                                                                           |
|------------------------------------|-------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| All resources of Kyma dependencies | CREATE, UPDATE, PATCH, and DELETE operations on the request level | Resource groups: • "cert.gardener.cloud" • "ory.sh" • "services.cloud.sap.com" • "extensions.istio.io" • "install.istio.io" • "networking.istio.io" • "security.istio.io" • "telemetry.istio.io" |
## Application Logs of System Components
Kyma runtime collects application logs provided by the Kyma system components. Those logs reflect regular events that occurred in Kyma runtime and must not include any personal or sensitive data. These are typically system-related activities and operations you can analyze to get more information about performance or to inspect potential problems.
## Related Information
https:/ /kubernetes.io/docs/tasks/debug/debug-cluster/audit/
Audit Logging in the Cloud Foundry Environment Audit Logging in the Neo Environment Access Kyma Application Logs [page 3161]