Audit logs
Two log streams: event audit logs for account and configuration activity, transfer logs for file movement. Both live in the admin portals under Security.
If an event isn't in the tables below, assume it isn't logged. This matters for compliance: don't design a control around an event Rescale doesn't record. Check the list before committing to an audit requirement.
Event audit logs
Transfer logs
The transfer log records every upload and download, and for each one it captures the file name, the file size, the IP address the transfer came from or went to, the user's email, and which client was used. Those last two fields together are what make it useful: the event audit log can tell you that someone was active, but only the transfer log answers "who took this data, and from where".
Who can see them
Availability depends on your Rescale edition. If you are an administrator and the Security tab shows no audit logs at all, the most likely explanation is that your edition does not include them, rather than a fault in the platform. Check with your account team before raising it as a bug.
Where to find them
Both logs live under the Security menu of an admin portal, and both portals have one. The organization portal's Security menu covers the whole organization and also holds password policy and SSO; a workspace portal's covers that workspace and holds the audit log alongside IP access rules and notifications.
There is no programmatic export
Audit and transfer logs cannot be exported programmatically. There's no endpoint, no scheduled export, and no supported path into a SIEM.
If your security team expects Rescale logs to flow into Splunk, Datadog, or similar, that is not currently possible and needs to be raised with your account team rather than solved at your end. Plan for manual review in the UI.
Only endpoints in the published API documentation are supported. Undocumented endpoints may change without notice: don't build an export against one.
What isn't logged
Worth stating explicitly, since absence is easy to assume away:
- Job submission and completion — those are in the job record, not the audit log
- File reads inside a running cluster — only platform transfers are logged
- Configuration changes generally — only the specific categories above
- Comment activity
Related
- Invite and manage users — the events that generate invitation and privilege entries
- Offboard a user — deactivations are recorded
- Single sign-on — SSO has its own sign-in view alongside these logs
- Budgets & deposits — budget changes are recorded