Auditing Query Examples

Shows the overall breakdown of every event type recorded in the window. Use this as a starting point for any compliance review — it immediately shows which operations are most frequent and flags any unexpected action types.

Answers "what has each user done?" — the primary view for user activity auditing. The combination of user_email and action gives a per-user summary of every operation type.

Scopes the previous query to a single user for detailed review. Replace the email address as needed.

Shows what kinds of resources have been changed and how — useful for understanding the scope of administrative activity.

Comparing success and failure counts across action types quickly surfaces failed mutations that may indicate permission gaps or misconfigured API calls.

Identifies users who are repeatedly hitting permission boundaries. A high count for a single user often indicates a misconfigured policy or an automation credential with insufficient permissions.

Tracks all user additions and removals across groups. resource_name is the group; the user being added or removed appears in resource_id.

Tracks when service account tokens are created or deleted, and which administrator performed the action.

The primary view for understanding who is driving platform load. Each row is a unique caller; rows with an empty user_email are alert evaluation or service-to-service calls.

Shows the distribution of queries across query services. Use this to understand relative load across telemetry types.

query-service dominates because it handles all PromQL queries, including every dashboard panel refresh and alert evaluation cycle.

Identifies users whose queries run slowest on average. High latency for a specific user often indicates broad time-range or high-cardinality queries.

Counts queries slower than a given threshold, grouped by service. Adjust the threshold to match your SLOs.

The 95th-percentile duration captures tail latency without being skewed by outliers. Use this alongside averages to identify services where most queries are fast but a significant tail is slow.

Plots total query throughput across all services in hourly buckets. Use this to identify traffic spikes, alert evaluation storms, or the effect of dashboard load patterns.

The output is a time-series table with one row per service per hour bucket, suitable for plotting in the Kloudfuse Metrics UI or exporting for trend analysis.