# Napter Audit Logs

Review on-demand remote access session logs.

**Napter Audit Log Updates**

- `CREATED`, `DELETED`, and `EXPIRED` events added.

Napter Audit Logs allow you to monitor connections to your devices made through the Napter on-demand remote access service.

Napter Audit Logs are disabled by default. However, events are still recorded and retained for 24 hours.

When enabled, logs are kept for 1 year (366 days) and can be downloaded using the Soracom API or Soracom CLI to assist in auditing the connections made to your devices.

> [!WARNING]
>
> Napter Audit Logs records connections made to your devices through the Napter on-demand remote access service. It is separate from the [Soracom Audit Logs](https://docs.soracom.io/en/services/account/audit-logs) feature, which records calls to the Soracom API made from your account.

## Enabling Napter Audit Logs

To enable Napter Audit Logs:

1. Sign in to the **[User Console](https://console.soracom.io/?coverage_type=g)**. From the **☰ Menu**, open the **Napter Audit Logs** screen.

   ![An image highlighting the Napter Audit Logs choice in the menu with an arrow](https://docs.soracom.io/_astro/napter-audit-logs-menu.CxfEpnal_Yze77.webp)

2. Click the **Subscribe** button, then click the **OK** button to confirm.

   ![An image of the Napter Audit Logs screen with an arrow pointing at the Subscribe button](https://docs.soracom.io/_astro/audit-logs-subscribe-1.CqPjXZ0t_2f7Ew8.webp) ![An image of the Napter Audit Logs Confirmation dialog showing Cancel and OK buttons](https://docs.soracom.io/_astro/audit-logs-subscribe-2.jBUxcu3E_tubHn.webp)

## Disabling Napter Audit Logs

To disable Napter Audit Logs:

1. Sign in to the **[User Console](https://console.soracom.io/?coverage_type=g)**. From the **☰ Menu**, open the **Napter Audit Logs** screen.

   ![An image highlighting the Napter Audit Logs choice in the menu with an arrow](https://docs.soracom.io/_astro/napter-audit-logs-menu.CxfEpnal_Yze77.webp)

2. Click the **Unsubscribe** button, then click the **OK** button to confirm.

   ![An image of the Napter Audit Logs screen with an arrow pointing at the Unsubscribe button](https://docs.soracom.io/_astro/audit-logs-unsubscribe-1.BfIE8OFC_2wO1k6.webp) ![An image of the Napter Audit Logs Confirmation dialog showing Cancel and OK buttons](https://docs.soracom.io/_astro/audit-logs-unsubscribe-2.IS18nJDu_Z1IIu9Q.webp)

   > [!NOTE]
   >
   > Note that when Napter Audit Logs is disabled, all prior logs will be automatically discarded. Even if you re-enable Napter Audit Logs, previous log entries will no longer be available.

## Viewing Logs

You can view Napter connection logs directly from the User Console.

1. Sign in to the **[User Console](https://console.soracom.io/?coverage_type=g)**. From the **☰ Menu**, open the **Napter audit logs** screen.

   ![Napter Audit Logs](https://docs.soracom.io/_astro/audit-logs.WWpuohL7_1X8F2B.webp)

### Log Entries

Each Napter Audit Logs entry will contain the following fields:

- **Source IP** and **Port** - The IP address and port of the remote device (such as a PC) initiating the remote connection

- **Destination IP** and **Port** - The IP address and port of the Soracom Air for Cellular device

- **Timestamp** - The date and time of the connection

- **Audit Type** - One of the following values describing the log entry:

  - `CREATED` - An on-demand remote access connection is created
  - `ACCESS` - An on-demand remote access connection is initiated and received by Napter
  - `CONNECTED` - Napter determined that the connection is allowed, and has established the connection to the device
  - `DENIED` - Napter determined that the connection is not allowed, and has forcefully rejected the connection
  - `REFUSED` - Napter detected a large number of connection requests within a short period, and has rejected the connection
  - `CLOSED` - The on-demand remote access connection is closed
  - `DELETED` - The on-demand remote access connection is deleted
  - `EXPIRED` - The on-demand remote access connection has expired

Each on-demand remote access connection will contain the following log entries:

- A `CREATED` entry, when the connection is created (for example, via the User Console)
- An `EXPIRED` entry, once the connection has expired, or a `DELETED` entry, if the connection is deleted manually

In addition, each connection _request_ will contain the following log entries:

- An `ACCESS` entry
- One of `CONNECTED`, `DENIED`, or `REFUSED`, depending on the connection status
- A `CLOSED` entry

The timing of the `CLOSED` entry may vary depending on the protocol used. For example, when accessing a device using SSH, the `CLOSED` entry will appear when the SSH _connection_ is closed. When accessing a device using HTTP, the `CLOSED` entry will appear when the browser _session_ has ended.

## Exporting Logs

When reviewing a large number of connection logs, Napter Audit Logs can also be exported using either the Soracom API or Soracom CLI.

### Soracom API

**Global**

```bash
curl -X GET \
  -H 'X-Soracom-API-Key: <my-api-key>' \
  -H 'X-Soracom-Token: <my-token>' \
  -H 'Accept: application/json' \
  https://g.api.soracom.io/v1/audit_logs/napter
```

**Japan**

```bash
curl -X GET \
  -H 'X-Soracom-API-Key: <my-api-key>' \
  -H 'X-Soracom-Token: <my-token>' \
  -H 'Accept: application/json' \
  https://jp.api.soracom.io/v1/audit_logs/napter
```

The API will return a JSON object containing Napter Audit Logs entries, ordered from newest to oldest:

```json
[
  {
    "operatorId": "OP0012345678",
    "imsi": "295000012345678",
    "connectionId": "abcdef00-0000-0000-0000-000012345678",
    "type": "ACCESS",
    "direction": {
      "destinationIPAddress": "10.1.2.3",
      "destinationPort": 22,
      "sourceIPAddress": "123.45.67.89",
      "sourcePort": 12345
    },
    "createdAt": 1570583864913,
    "tls": false
  }
]
```

You can also specify **query parameters** to limit the results of the export:

- **resource\_id** - The IMSI of the Air for Cellular subscriber
- **from** and **to** - Unix timestamps (milliseconds) to define the log range
- **limit** - Limit the number of records to be returned

For more information, refer to the [getNapterAuditLogs API documentation](https://docs.soracom.io/en/api#!/AuditLog/getNapterAuditLogs).

### Soracom CLI

Run the following command:

**Global**

```bash
soracom audit-logs napter get --coverage-type g
```

**Japan**

```bash
soracom audit-logs napter get --coverage-type jp
```

The CLI will return a response similar to the above API example.

Similarly, the following flags are available for limiting the results:

- `--resource-id` - The IMSI of the Air for Cellular subscriber
- `--from` and `--to` - Unix timestamps (milliseconds) to define the log range
- `--limit` - Limit the number of records to be returned

## Log Access Quota

Each Soracom account is allowed a monthly quota of 3GB for accessing Napter Audit Logs data. This includes viewing log entries from the **Audit Logs** screen on the User Console, as well as exporting logs via the Soracom API and Soracom CLI.

If you exceed the 3GB allowance within one month, each subsequent 1GB will be charged an additional fee. Refer to the [Pricing & Fee Schedule](https://docs.soracom.io/en/pricing) for further information.

Soracom provides a Soracom API endpoint as well as a Soracom CLI command that allows you to check your current Napter Audit Logs access usage:

**Global**

```bash
curl -X GET \
  -H 'X-Soracom-API-Key: <my-api-key>' \
  -H 'X-Soracom-Token: <my-token>' \
  -H 'Accept: application/json' \
  https://g.api.soracom.io/v1/stats/napter/audit_logs
```

**Japan**

```bash
curl -X GET \
  -H 'Accept: application/json' \
  -H 'X-Soracom-API-Key: <my-api-key>' \
  -H 'X-Soracom-Token: <my-token>' \
  https://jp.api.soracom.io/v1/stats/napter/audit_logs
```

**Global**

```bash
soracom stats napter audit_logs --coverage-type g
```

**Japan**

```bash
soracom stats napter audit_logs --coverage-type jp
```

In either case, the API or CLI will return the total number of **bytes** used so far.