# Ensure Account Audit Logs Are Forwarded to Logs Data Platform

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826025890674-ensure-account-audit-logs-are-forwarded-to-logs-data-platform
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the OVHcloud account audit logs, which record security events such as logins, password changes, and two-factor authentication changes, are forwarded to a data stream in a Logs Data Platform (LDP) account, so they can be stored, searched, and used for alerts.

**Rationale**

Audit logs show who signed in and when security settings changed, which is essential for detecting account takeover and investigating incidents. Forwarding them to Logs Data Platform keeps them in a searchable store, allows alerts on suspicious events, and supports compliance retention requirements.

**Impact**

-   Security events are kept and can be searched
    
-   Enables alerts on suspicious logins or changes
    
-   Logs Data Platform storage is billed
    

**Default Value**

By default, account audit logs are not forwarded to Logs Data Platform.

**Pre-Requisites**

-   Access to the OVHcloud account owner login or an IAM administrator
    
-   A Logs Data Platform account in the same OVHcloud account with at least one active data stream
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select Account Logs. The page shows three tabs: Access policy logs, Activity logs, and Audit logs.
    
4.  Open the Audit logs tab and check the subscription panel for an active subscription to a Logs Data Platform data stream.
    
5.  Alternatively, run GET /me/logs/audit/log/subscription in the API console at [https://eu.api.ovh.com/console/](https://eu.api.ovh.com/console/) (or your region's console) and check that a subscription exists.
    
6.  If no subscription exists, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select Account Logs and open the Audit logs tab.
    
4.  In the subscription panel, select your Logs Data Platform account, then click Subscribe on the data stream that should receive the logs.
    
5.  Confirm that the subscription appears as active and that audit logs start arriving in the data stream (Identity, Security & Operations > Logs Data Platform > your account > Data stream tab).
    
6.  Alternatively, with the API: copy the stream ID from the Data stream tab of your Logs Data Platform account (Copy stream ID), then run POST /me/logs/audit/log/subscription with the streamId.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select Account Logs, open the Audit logs tab, and click Unsubscribe on the data stream.
    
4.  Alternatively, run DELETE /me/logs/audit/log/subscription/{subscriptionId} in the API console.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/manage-and-operate/iam/logs-forwarding](https://docs.ovhcloud.com/en/guides/manage-and-operate/iam/logs-forwarding)
    
-   [https://support.us.ovhcloud.com/hc/en-us/articles/28789800400659-Generating-OVHcloud-account-logs-with-Logs-Data-Platform](https://support.us.ovhcloud.com/hc/en-us/articles/28789800400659-Generating-OVHcloud-account-logs-with-Logs-Data-Platform)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.