> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit event export

Package Security Manager can be configured to automatically generate and export a list of events from the system to external storage, such as an Amazon Web Services (AWS) Simple Storage Service (S3) bucket, or to a valid network storage location.

Anaconda records the following events for export, organized by type:

> [accordion] Event types
>
> > [accordion] artifact
> >
> > * `artifact_copied`
> > * `artifact_downloaded`
> > * `artifact_generated`
> > * `artifact_metadata_updated`
> > * `artifact_registered`
> > * `artifact_removed`
> > * `artifact_skipped`
> > * `artifact_view_refreshed`
>
> > [accordion] authentication
> >
> > * `auto_role_added`
> > * `auto_role_deleted`
> > * `auto_role_updated`
>
> > [accordion] build
> >
> > * `build_channel_cve_notification`
>
> > [accordion] channel
> >
> > * `channel_created`
> > * `channel_cve_count_update`
> > * `channel_deleted`
> > * `channel_group_added`
> > * `channel_group_deleted`
> > * `channel_refresh_complete`
> > * `channel_reindex`
> > * `channel_unfrozen`
> > * `channel_updated`
>
> > [accordion] cve
> >
> > * `cve_deleted`
> > * `cve_update_finished`
> > * `cve_updated`
>
> > [accordion] group
> >
> > * `group_user_added`
> > * `group_user_deleted`
>
> > [accordion] mirror
> >
> > * `mirror_deleted`
> > * `mirror_registered`
> > * `mirror_updated`
>
> > [accordion] mirroring
> >
> > * `mirroring_completed`
> > * `mirroring_failed`
> > * `mirroring_started`
> > * `mirroring_stopped`
>
> > [accordion] report
> >
> > * `report_generated`
>
> > [accordion] sbom
> >
> > * `sbom_deleted`
> > * `sbom_updated`
>
> > [accordion] user
> >
> > * `user_token_created`
> > * `user_token_metadata_updated`
> > * `user_token_revoked`
> > * `user_token_updated`

To establish a background job to generate and export a chronological recording of events that have occurred within the system:

1. Open a terminal and connect to your instance of Package Security Manager.

2. Open your installer directory, where the `docker-compose.yml` file is located, by running the command:

   ```sh theme={null}
   # Replace <INSTALLER> with the name of your installer directory
   cd <INSTALLER>.
   ```

3. Open your `docker-compose.yml` file using your preferred file editor.

4. Find the `repo_worker:` section of the file.

5. Add the following variables to the `repo_worker:` `environment:` section:

   | Variable | Description |
   | :- | :- |
   | `REPO_ENABLE_GENERATE_AUDIT_REPORTS=true` | Required. Enables the background job to operate. |
   | `REPO_SCHEDULE_AUDIT_REPORT_CRON=<CRON>` | Required. Sets the frequency of the job. Replace `<CRON>` [with a valid CRON expression](https://crontab.guru/). |
   | `REPO_AUDIT_REPORT_FS=<PARENT_DIRECTORY>` | Required. Replace `<PARENT_DIRECTORY>` with an S3 bucket location or a valid file directory path, like `file://{BASE_PATH}/statedir/audit-logs` |
   | `REPO_AUDIT_REPORT_DOWNLOAD_AS=<FORMAT>` | Optional. Can set the output for the report as either `csv` or `json`. If this value is not provided, the report will default to `csv` format. |
   | `REPO_CONFIGURE_AUDIT_EVENT_TYPES=<TYPE>,<TYPE>` | Optional. Specifies that the job only generates and exports these value types in the report. Replace `<TYPE>` with event types [as described above](#event-types). Separate types with a comma. You can include as many event types as you require. If this variable is not provided, you will generate a report for all events. |
   | `REPO_AUDIT_REPORT_FS_KMS_ID=<KMS_ID>` | As necessary. Replace `<KMS_ID>` with your S3 bucket KMS ID, if it has one. |

6. Restart the `repo_worker` container by running the following command:

   ```sh theme={null}
   docker compose up --detach
   ```

> [!NOTE]
>
> If you are using the `REPO_CONFIGURE_AUDIT_EVENT_TYPES=` variable, the report will include the `artifact_downloaded` events even if you do not include it.