---
title: The Event and Audit Logs
slug: ps/help/en_us/vtm/userguide/the-event-and-audit-logs
docTags: 
createdAt: 2026-08-02T07:48:41.724Z
---

The event log contains system and configuration messages, warnings, and errors from all Virtual Traffic Managers in your cluster. A truncated version of the event log can be found on the Home page of the Virtual Traffic Manager Admin UI. To view the full logs, click **Examine Logs** or **Diagnose > Event Log**.

The audit log monitors recent login attempts, configuration changes (by user and source IP address), and user logouts. It also records changes made using the Control API and REST API. To view the audit log, click **Diagnose > Audit Log** in the Virtual Traffic Manager Admin UI.

For virtual appliances and cloud instances, the Virtual Traffic Manager controls event log and audit log rotation automatically. Logs are rotated once the maximum file size of 50MB is reached for the current log. As the log is rotated, a new archive file is created for the log entries up to that point, and the current log cleared. Archive files are then compressed with "gzip" and given a filename in the format shown here:

- **For audit logs**: audit-\<date>-\<sequence>.gz
- **For event logs**: event-\<date>-\<sequence>.gz

where \<sequence> is an incremental number provided for multiple same-day rotations.

For Virtual Traffic Manager software variants, you must enact your own rotation policy.

To access archived audit log files, click **Manage archived audit logs** on the **Diagnose > Audit Log** page. To access archived event log files, click **Manage archived event logs** on the **Diagnose > Event Log** page.

For each archived log, you can download or delete the file using the controls provided.

:::hint{type="info"}
To override the default maximum file size used by the Virtual Traffic Manager for audit and event log file rotation, set the system level environment variables AUDITLOG\_ROTATE\_THRESHOLD or EVENTLOG\_ROTATE\_THRESHOLD correspondingly, although certain appliance and cloud variants might have an alternate automatic threshold that is implemented in place of this. For more details, see the Virtual Traffic Manager: Installation and Getting Started Guide applicable to your product variant.
:::