Description

Ensure the OVHcloud account activity logs, which record every action made through the API and the Control Panel, are forwarded to a data stream in a Logs Data Platform (LDP) account, so they can be stored, searched, and used for investigations.

Rationale

Activity logs show who changed what in the account, such as creating, deleting, or modifying services. Without them, it is hard to investigate incidents or detect unauthorized changes. Forwarding them to Logs Data Platform keeps a searchable record that supports alerting and compliance.

Impact

  • Every API and Control Panel action is recorded

  • Supports investigations and change tracking

  • Logs Data Platform storage is billed

Default Value

By default, account activity logs are not forwarded to Logs Data Platform.

Pre-Requisites

  • Access to the OVHcloud account owner login or an IAM administrator

  • A Logs Data Platform account in the same OVHcloud account with at least one active data stream

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select Account Logs. The page shows three tabs: Access policy logs, Activity logs, and Audit logs.

  4. Open the Activity logs tab and check the subscription panel for an active subscription to a Logs Data Platform data stream.

  5. Alternatively, run GET /me/api/log/subscription in the API console at https://eu.api.ovh.com/console/ (or your region's console) and check that a subscription exists.

  6. If no subscription exists, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select Account Logs and open the Activity logs tab.

  4. In the subscription panel, select your Logs Data Platform account, then click Subscribe on the data stream that should receive the logs.

  5. Confirm that the subscription appears as active and that activity logs start arriving in the data stream (Identity, Security & Operations > Logs Data Platform > your account > Data stream tab).

  6. Alternatively, with the API: copy the stream ID from the Data stream tab of your Logs Data Platform account (Copy stream ID), then run POST /me/api/log/subscription with the streamId.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select Account Logs, open the Activity logs tab, and click Unsubscribe on the data stream.

  4. Alternatively, run DELETE /me/api/log/subscription/{subscriptionId} in the API console.

Reference