> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit event export

Package Security Manager (On-prem) can be configured to automatically generate and export a list of events from the system to external storage, such as an Amazon Web Services (AWS) Simple Storage Service (S3) bucket, or to a valid network storage location.

Anaconda records the following events for export, organized by type:

<Accordion title="Event types">
  <AccordionGroup>
    <Accordion title="artifact">
      * `artifact_copied`
      * `artifact_downloaded`
      * `artifact_generated`
      * `artifact_metadata_updated`
      * `artifact_registered`
      * `artifact_removed`
      * `artifact_skipped`
      * `artifact_view_refreshed`
    </Accordion>

    <Accordion title="authentication">
      * `auto_role_added`
      * `auto_role_deleted`
      * `auto_role_updated`
    </Accordion>

    <Accordion title="build">
      * `build_channel_cve_notification`
    </Accordion>

    <Accordion title="channel">
      * `channel_created`
      * `channel_cve_count_update`
      * `channel_deleted`
      * `channel_group_added`
      * `channel_group_deleted`
      * `channel_refresh_complete`
      * `channel_reindex`
      * `channel_unfrozen`
      * `channel_updated`
    </Accordion>

    <Accordion title="cve">
      * `cve_deleted`
      * `cve_update_finished`
      * `cve_updated`
    </Accordion>

    <Accordion title="group">
      * `group_user_added`
      * `group_user_deleted`
    </Accordion>

    <Accordion title="mirror">
      * `mirror_deleted`
      * `mirror_registered`
      * `mirror_updated`
    </Accordion>

    <Accordion title="mirroring">
      * `mirroring_completed`
      * `mirroring_failed`
      * `mirroring_started`
      * `mirroring_stopped`
    </Accordion>

    <Accordion title="report">
      * `report_generated`
    </Accordion>

    <Accordion title="sbom">
      * `sbom_deleted`
      * `sbom_updated`
    </Accordion>

    <Accordion title="user">
      * `user_token_created`
      * `user_token_metadata_updated`
      * `user_token_revoked`
      * `user_token_updated`
    </Accordion>
  </AccordionGroup>
</Accordion>

To establish a background job to generate and export a chronological recording of events that have occurred within the system:

1. Open a terminal and connect to your instance of Package Security Manager.

2. Open your installer directory, where the `docker-compose.yml` file is located, by running the command:

   ```sh theme={null}
   # Replace <INSTALLER> with the name of your installer directory
   cd <INSTALLER>.
   ```

3. Open your `docker-compose.yml` file using your preferred file editor.

4. Find the `repo_worker:` section of the file.

5. Add the following variables to the `repo_worker:` `environment:` section:

   | Variable                                         | Description                                                                                                                                                                                                                                                                                                                      |
   | :----------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | `REPO_ENABLE_GENERATE_AUDIT_REPORTS=true`        | Required. Enables the background job to operate.                                                                                                                                                                                                                                                                                 |
   | `REPO_SCHEDULE_AUDIT_REPORT_CRON=<CRON>`         | Required. Sets the frequency of the job. Replace `<CRON>` [with a valid CRON expression](https://crontab.guru/).                                                                                                                                                                                                                 |
   | `REPO_AUDIT_REPORT_FS=<PARENT_DIRECTORY>`        | Required. Replace `<PARENT_DIRECTORY>` with an S3 bucket location or a valid file directory path, like `file://{BASE_PATH}/statedir/audit-logs`                                                                                                                                                                                  |
   | `REPO_AUDIT_REPORT_DOWNLOAD_AS=<FORMAT>`         | Optional. Can set the output for the report as either `csv` or `json`. If this value is not provided, the report will default to `csv` format.                                                                                                                                                                                   |
   | `REPO_CONFIGURE_AUDIT_EVENT_TYPES=<TYPE>,<TYPE>` | Optional. Specifies that the job only generates and exports these value types in the report. Replace `<TYPE>` with event types [as described above](#event-types). Separate types with a comma. You can include as many event types as you require. If this variable is not provided, you will generate a report for all events. |
   | `REPO_AUDIT_REPORT_FS_KMS_ID=<KMS_ID>`           | As necessary. Replace `<KMS_ID>` with your S3 bucket KMS ID, if it has one.                                                                                                                                                                                                                                                      |

6. Restart the `repo_worker` container by running the following command:

   ```sh theme={null}
   docker compose up -d
   ```

<Note>
  If you are using the `REPO_CONFIGURE_AUDIT_EVENT_TYPES=` variable, the report will include the `artifact_downloaded` events even if you do not include it.
</Note>