Features

Audit Logs

Every manifest pull attempt logged. Filter, search, and export for compliance.

Using an AI assistant? Give it this file.

/llms.md is a single Markdown file covering installation, configuration, quickstart, clients, upstreams, permissions, TLS, and production deployment. Copy it and paste it into your AI chat, or tell the AI to fetch https://drevnix.tech/llms.md.

Audit Logs

Every manifest pull attempt through the Drevnix proxy is recorded in the audit log. The log captures the client, upstream, repository, tag, HTTP status code, client IP, and timestamp, giving you a complete, searchable record of all image access.

Audit log retention is controlled by your license.

What is logged

Field	Description
`requested_at`	UTC timestamp, millisecond precision
`client_id`	Which client made the request
`upstream_id`	Which upstream registry was accessed
`repository`	Image repository path
`reference`	Tag or digest
`http_status`	`200`, `401`, `403`, `404`, etc.
`client_ip`	Real client IP (uses `X-Forwarded-For` leftmost token when `TRUSTED_PROXIES` is set and request arrives from a trusted proxy)

What is not logged: Blob downloads (individual layer fetches). Only manifest pulls are logged. This is the meaningful access event that resolves which image a client requested.

Browsing the audit log

Go to Audit Logs in the portal. Filter by:

Date range: from / to (UTC)
Client ID: exact match
Upstream ID: exact match
Repository: substring search
HTTP status: filter by status code

Results are paginated. Click any entry to see the full details.

Common queries

Who pulled this image? Filter by repository substring (e.g. myorg/api) to see every client that resolved it.

What did a CI pipeline pull last month? Filter by client_id = ci-pipeline-prod and set a 30-day date range.

Show all denied requests: Filter by HTTP status 403 (permission denied) or 401 (authentication failed).

Exporting via API

curl "http://drevnix.company.com:8002/v1/audit?client_id=ci-pipeline-prod&from=2025-01-01T00:00:00Z" \
  -u admin:password

Use the export for SIEM ingestion, SOC2/ISO 27001 auditor deliverables, or internal security reviews.

Retention

Audit logs are retained for AUDIT_RETENTION_DAYS (default: 90 days). Old entries are pruned automatically. Adjust the retention period before it matters. Pruned entries cannot be recovered.

For compliance frameworks that require longer retention (SOC2 Type II typically covers 12 months), set AUDIT_RETENTION_DAYS=365 or export logs regularly to an external store such as an S3 bucket or a SIEM.