Audit Log Reference

Published July 28, 2026 | Last modified November 9, 2026

Overview

Use this reference to look up the fields F5 Distributed Cloud Services writes to audit logs. Audit logs record actions performed on objects. F5 stores them on the Global Controller with longer retention than application logs.

Types of audit logs

Distributed Cloud Services generates two types of audit logs: success and failure. The log information is stored in JSON format. Some information is unique to each type of log, and other information is present in both.

Important: Don't edit or take action on keys marked For use by F5 only in the Description column. F5 will remove these keys in a future release.

Key	Success	Failure	Description
`kubernetes`	✅	✅	For use by F5 only.
`dst`	✅	✅	Destination service, origin server, or endpoint receiving the request.
`dst_site`	✅	✅	Routes traffic to the destination endpoint or origin.
`time_start`	✅	✅	Timestamp when request processing started.
`messageid`	✅	✅	Unique identifier for the audit event.
`trace_info`	✅	✅	Distributed tracing identifier used for request correlation across services.
`rsp_seconds`	✅	✅	Seconds spent processing the request and generating a response.
`src_site`	✅	✅	Site that originally received the request.
`hostname`	✅	✅	For use by F5 only.
`original_tenant`	✅	✅	Original tenant associated with the request.
`<uuid>.user_message`	✅	✅	Human-readable description of the audit outcome.
`stream`	✅	✅	For use by F5 only.
`host`		✅	Host IP address associated with the log record.
`req_headers`		✅	Request headers captured for the request.
`message_key`	✅	✅	Internal unique key used for log indexing and correlation.
`tenant`	✅	✅	Tenant owning the resource or request.
`user_agent`	✅	✅	HTTP User-Agent header value.
`app`	✅	✅	For use by F5 only.
`severity`	✅	✅	Severity level of the audit event.
`cluster_name`	✅	✅	For use by F5 only.
`ctx_creatorid`	✅	✅	Identity of the user who started the operation.
`method`	✅	✅	HTTP method used by the request.
`rpc`	✅	✅	Internal API/RPC method called.
`src`	✅	✅	Source service or origin of the request.
`rsp_code`	✅	✅	HTTP response status code returned by the operation.
`ctx_creatorcls`	✅	✅	Client class that sent the request (for example, Prism).
`transport`	✅	✅	Transport protocol used by the API (for example, REST, gRPC, and others).
`message`	✅	✅	Summary or type of audit event.
`server_id`	✅	✅	Identifier of the service instance generating the record.
`site`	✅	✅	For use by F5 only.
`@timestamp`	✅	✅	For use by F5 only.
`namespace`	✅	✅	Namespace/workspace containing the managed resource.
`req_path`	✅	✅	HTTP request path.
`time`	✅	✅	Event timestamp.
`user`	✅	✅	Signed-in user for the request.
`original_topic_name`	✅	✅	Original message topic from which the audit event was published.
`peer_CN`	✅	✅	Common Name (CN) from the peer certificate identity.
`req_body`		✅	Request payload submitted to the API.
`req_error`		✅	Error details returned when request validation or processing failed.
`<uuid>.rsp_body`	✅		Response payload for the audited object operation.
`<uuid>.req_body`	✅		Request payload associated with the audited object operation.
`<uuid>.oper_name`	✅		Object lifecycle operation performed (for example, Create, Update, Delete, and more).
`<uuid>.object_json`	✅		Complete serialized representation of the affected resource.
`req_size`	✅		Size of the request payload in bytes.
`<uuid>.object_type`	✅		Schema type of the affected object.
`rsp_body`	✅		API response payload; may contain `DEPRECATED` placeholder values.
`rsp_size`	✅		Size of the response payload in bytes.
`<uuid>.object_name`	✅		Name of the affected resource.
`<uuid>.object_uid`	✅		Unique identifier (UID) of the affected resource.
`<uuid>.object_namespace`	✅		Namespace containing the affected resource.
`oper_diff`	✅		Unified differential of old versus new specification. Emitted only on successful Replace/Update operations.

Universally unique identifier prefix convention

Universally unique identifier (UUID) prefixes are log document identifiers. F5 hardcodes UUID prefixes in the platform source and has not changed them since introduction. There is no external contract guaranteeing their stability across releases. They are unlikely to change. F5 Distributed Cloud Console handles these identifiers dynamically.

Because the UUID prefix varies by log document type, use regex or suffix-based field extraction in your SIEM parser. Match on the field name suffix (.req_body, .rsp_body, .oper_diff, .oper_name) rather than the full key that includes the UUID.

Example of failure audit log

{
  "kubernetes": {},
  "dst": "<DST>",
  "dst_site": "UNKNOWN",
  "time_start": "2026-06-11 23:13:46.800759613 +0000 UTC m=+146444.274632121",
  "messageid": "942ceca3-5e0a-492d-baea-64a2a71657f2",
  "trace_info": "21de9d1397943cd2:21de9d1397943cd2:0000000000000000:1",
  "rsp_seconds": 0.000940851,
  "src_site": "UNKNOWN",
  "hostname": "<HOSTNAME>",
  "original_tenant": "<TENANT>",
  "caf4bbc7-8c99-4614-8224-b24562a28a83.user_message": "A 'dns_load_balancer' create attempt failed validation.",
  "stream": "svcfw",
  "host": "<HOST-IPADDRESS>",
  "req_headers": "map[Accept:[application/json] Accept-Encoding:[gzip, deflate, br, zstd] Accept-Language:[en-US,en;q=0.9] Baggage:[sentry-environment=production,sentry-release=stellar%4081794ed7,sentry-public_key=71685aad0fd242dfab536b77770de57d,sentry-trace_id=8c450aec4a0b41d485dd8dd580bdc8bb,sentry-sample_rate=1,sentry-sampled=true] Content-Length:[383] Content-Type:[application/json] Cookie:[s_fid=743462CC04F2FEA1-1B042D1353B24A64; AMCVS_347AE3BC558C64417F000101%40AdobeOrg=1; s_cc=true; notice_behavior=implied,eu; notice_preferences=2:; TAconsentID=1533e7a9-475e-4694-a2ee-3dc75a5ce1de; notice_gdpr_prefs=0,1,2:; cmapi_gtm_bl=; cmapi_cookie_privacy=permit 1,2,3; _ga_LCQJ4PN7YC=GS2.1.s1781037529$o8$g0$t1781037529$j60$l0$h0; AMCV_347AE3BC558C64417F000101%40AdobeOrg=359503849%7CMCIDTS%7C20616%7CMCMID%7C11580729639282519162395750200226723139%7CMCAAMLH-1781816314%7C9%7CMCAAMB-1781816314%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1781218714s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.0.1; _ga=GA1.2.1627976970.1779122724; _gid=GA1.2.1956504791.1781211515; utag_main=v_id:019e3bfa4ec500591f20e7fd357005075012006d00b3b$_sn:17$_se:4$_ss:0$_st:1781221367997$vapi_domain:volterra.us$ses_id:1781219371478%3Bexp-session$session; s_sq=f5networksvolterraconsoleprod%3D%2526pid%253Dhttps%25253A%25252F%25252F<TENANT>%25252Fweb%25252Fhome%2526oid%253DAdd%252520DNS%252520Load%252520Balancer%2526oidt%253D3%2526ot%253DSUBMIT] Origin:[<TENANT>] Priority:[u=1, i] Referer:[https://<TENANT>/web/workspaces/dns-management/manage/dns_lb_management/dns_load_balancer] Sec-Ch-Ua:[\"Chromium\";v=\"148\", \"Google Chrome\";v=\"148\", \"Not/A)Brand\";v=\"99\"] Sec-Ch-Ua-Mobile:[?0] Sec-Ch-Ua-Platform:[\"macOS\"] Sec-Fetch-Dest:[empty] Sec-Fetch-Mode:[cors] Sec-Fetch-Site:[same-origin] Sentry-Trace:[8c450aec4a0b41d485dd8dd580bdc8bb-93cd0d67741d665e-1] User-Agent:[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36] X-Envoy-Expected-Rq-Timeout-Ms:[60000] X-Envoy-External-Address:[<IPADDRESS>] X-Envoy-Original-Authority:[<TENANT>] X-Envoy-Original-Path:[/api/config/dns/namespaces/system/dns_load_balancers?csrf=eyJ0ZW5hbnQiOiJjdXN0b21lcjEiLCJ1c2VyIjoicy5sYXRlZWZAZjUuY29tIiwiZXhwaXJ5IjoiMTc4MTIxMTUxNDkwMjI4ODAwMDAifQ==.0f7dc8a6239f744f78141a5b39d39a64edbe3190a3b03c2fe4fc7db5a06f2b30] X-Forwarded-Client-Cert:[Hash=3a63f8cf9e4a7dba4ebcfa9af30510124bf90f78a720947e153d9b6264dfe7bf Cert=\"-----BEGIN%20CERTIFICATE-----<CERTIFICATE>-----END%20CERTIFICATE-----%0A\"] X-Forwarded-For:[<IPADDRESS>] X-Forwarded-Proto:[https] X-Request-Id:[5decac8b-5486-4402-b74a-66560a58357d] X-Volterra-Apigw-Authtype:[oidc] X-Volterra-Apigw-F5xc-Instance:[gc01] X-Volterra-Apigw-Namespace:[system] X-Volterra-Apigw-Original-Tenant:[<TENANT>] X-Volterra-Apigw-Real-Src-Ip:[IPADDRESS] X-Volterra-Apigw-Role:[ves-io-admin-role] X-Volterra-Apigw-Tenant:[<TENANT>] X-Volterra-Apigw-Tenant-Cname:[<TENANT>] X-Volterra-Apigw-User:[name@f5.com] X-Volterra-Gw-Skip-Jwt:[true]]",
  "message_key": "8189266518350495310",
  "tenant": "<TENANT>",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36",
  "app": "<APP>",
  "severity": "info",
  "cluster_name": "<CLUSTER-NAME>",
  "ctx_creatorid": "name@f5.com",
  "method": "POST",
  "rpc": "ves.io.schema.dns_load_balancer.API.Create",
  "src": "N:Public",
  "rsp_code": 400,
  "ctx_creatorcls": "prism",
  "transport": "rest",
  "message": "API Audit post-handling",
  "server_id": "<SERVER-ID>",
  "site": "<SITE>",
  "@timestamp": "2026-06-11T23:13:46.801Z",
  "req_body": "{\"namespace\":\"system\",\"metadata\":{\"name\":\"name-test-dns\",\"description\":\"Name test DNS\",\"disable\":false},\"spec\":{\"record_type\":\"MX\",\"rule_list\":{\"rules\":[{\"geo_location_label_selector\":{\"expressions\":[\"geoip.ves.io/continent = EU\"]},\"pool\":{\"tenant\":\"<TENANT>\",\"namespace\":\"system\",\"name\":\"aj-go-lb-pool4-a-members-cule\",\"kind\":\"dns_lb_pool\"}}]},\"response_cache\":{\"disable\":{}}}}",
  "req_error": "{\"code\":3,\"details\":[{\"code\":\"UNKNOWN\",\"details\":\"items rules: element 0: Field spec.rule_list.rules.score fails rule ves.io.schema.rules.uint32.gte constraint 1 due to value 0\",\"timestamp\":\"2026-06-11T23:13:46Z\"}],\"message\":\"Field spec.rule_list.rules.score should be greater than or equal to 1, got 0 in request.\"}",
  "namespace": "system",
  "req_path": "/public/namespaces/system/dns_load_balancers",
  "time": "2026-06-11T23:13:46.801Z",
  "user": "name@f5.com",
  "original_topic_name": "fluentd.svcfw.publicaudit",
  "peer_CN": "prism"
}

Example of success audit log