# Ensure Kubernetes Audit Logs Are Forwarded

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826031401878-ensure-kubernetes-audit-logs-are-forwarded
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Kubernetes API server audit logs of each Managed Kubernetes cluster are forwarded to a Logs Data Platform data stream, so every request to the cluster API is recorded and can be searched.

**Rationale**

Audit logs show who accessed or changed the cluster, such as creating pods, reading secrets, or changing RBAC. Without them, it is very hard to detect misuse or investigate an incident. Forwarding them to Logs Data Platform keeps a searchable record for security and compliance.

**Impact**

-   Every API request to the cluster is recorded
    
-   Supports investigations and alerts
    
-   Logs Data Platform storage is billed
    

**Default Value**

By default, Kubernetes audit logs are not forwarded.

**Pre-Requisites**

-   Permission to manage the Kubernetes cluster
    
-   A Logs Data Platform account with an active data stream
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the cluster's Audit Logs tab and check the subscription panel for an active subscription to a data stream.
    
5.  If no subscription exists, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In Identity, Security & Operations, select Logs Data Platform, open your LDP account, go to the Data stream tab, and click Copy stream ID on the target stream.
    
3.  In the left-hand menu, select Public Cloud and choose your project.
    
4.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
5.  Open the Audit Logs tab and, in the subscription panel, select your Logs Data Platform account and click Subscribe on the target data stream.
    
6.  Confirm that audit logs appear in the data stream.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Kubernetes Service, then click the cluster name to open it.
    
4.  Open the Audit Logs tab and click Unsubscribe on the data stream.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/public-cloud/cross-functional/logs-concepts](https://docs.ovhcloud.com/en/guides/public-cloud/cross-functional/logs-concepts)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.