User Audit for New Relic

Enter an email address and press Audit. You get three things: what that person has been running, the groups they belong to, and the changes they have made.

Print puts the whole audit on paper, or into a PDF from the print dialog. The search box and the buttons come off, the report states who it is about and over what windows, and the groups are opened so the printed copy names every grant rather than counting them.

Query activity

New Relic logs every NRQL query it runs with the person behind it, which is how this can say what someone actually looks at rather than only what they are allowed to see. The panel reports where their queries came from, which parts of New Relic they were in, the dashboards they opened, whether any of it came through an API key, and the accounts they queried.

Two things the numbers do not mean. A dashboard re-runs its widget queries on every refresh, so these are query executions rather than visits: one dashboard left open on a wall screen outnumbers a person who opened ten. And the log is kept about 30 days, so this window is shorter than the audit records below however long a window you ask for.

Every account the person's groups grant is counted, and the busiest ten are broken down: someone can hold access to fifty accounts and run everything in one. A person who queried through a user key is shown the key's id and how much went through it, which is what separates a colleague reading dashboards from a script.

Group membership

Every group across every authentication domain, expanded to show what each one actually grants: account ID, account name, and role. Groups are collapsed by default because a senior user can sit in dozens of groups granting dozens of accounts each. The summary line gives the group count and the number of distinct accounts.

Organization wide roles

Groups carrying one are expanded automatically and flagged. Those govern the organization and user management rather than one account's data, and because they can grant account access the effective ceiling is the whole estate rather than the accounts listed.

What the audit records cover

Identity and access events are organization scoped and land in a single account, which is where these are read from. Logins, group changes, access grants, role updates and dashboard edits all appear. Actions taken inside another account are audited in that account and are not included here, so an empty list is not proof of inactivity.

Nothing on this screen is cached. Access changes are exactly what you would be checking for, so every lookup queries New Relic directly.