Not able to query git events in audit logs.

[aditya-shrivastavv]

Select Topic Area

Question

Body

https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise#example-3-events-for-git-activity-in-an-enterprise-for-a-specific-date-and-actor

This documentation says that we can use &include=git but still not able see git event logs. Normal github based events are visible like: pull_request.merge, repo.download_zip, Is it related to permission of the token? I have given permission read:audit_log as suggested in doc.

curl -H "Authorization: Bearer TOKEN" \
     -H "Accept: application/vnd.github+json" \
     "https://api.github.com/orgs/ORG/audit-log?phrase=actor:USERNAME&include=git"

Edit:

• I even tried with token with admin:org scope, but still not getting those logs.

[elbachir-one]

Select Topic Area

Question

Body

https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise#example-3-events-for-git-activity-in-an-enterprise-for-a-specific-date-and-actor

This documentation says that we can use &include=git but still not able see git event logs. Normal github based events are visible like: pull_request.merge, repo.download_zip, Is it related to permission of the token? I have given permission read:audit_log as suggested in doc.

curl -H "Authorization: Bearer TOKEN" \
     -H "Accept: application/vnd.github+json" \
     "https://api.github.com/orgs/ORG/audit-log?phrase=actor:USERNAME&include=git"

Git-related audit log events (like git.push, git.clone, git.fetch) are only retained for seven days via the REST API.

[aditya-shrivastavv]

@elbachir-one I am cloning a repo and checking the entry in the audit logs, but the request is returning and empty array

[elbachir-one]

@aditya-shrivastavv In your case, the empty array is most likely because either you’re querying the organization endpoint instead of the enterprise endpoint, or the clone was unauthenticated/public, so no audit entry was generated.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬