> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to export audit events to Object Storage

*Audit event export* lets you deliver [audit events](./view) for a fixed time range to an [Object Storage bucket](/object-storage/overview#buckets). Exports are one-time and run asynchronously, writing files directly to the bucket. This is useful for long-term retention, processing data in external tools, and [data portability](/overview/data-portability). After the export completes, you can download the exported objects from the bucket to store them locally or move them to a different provider.

## Prerequisites

<Warning>
  Currently, exporting audit events is only possible to a bucket located in the `eu-north1` region. For example, you can export audit events for resources located in `us-central1` region only to a bucket located in `eu-north1` region.
</Warning>

* [Install and configure the Nebius AI Cloud CLI](/cli/quickstart).
* Make sure you are in a [group](/iam/authorization/groups/index) that has the `admin` role within your tenant; for example, the default `admins` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.
* Make sure that you have the `storage.uploader` role for the destination Object Storage bucket.

## How to export events

1. Copy the ID of the tenant you want to export events for:

   ```bash theme={null}
   nebius iam tenant list
   ```

2. Select an existing bucket or [create a new one](/object-storage/buckets/manage#how-to-create-buckets). Copy the bucket ID.

3. Start an export:

   ```bash theme={null}
   nebius audit v2 audit-event-export start \
      --parent-id <tenant_ID> \
      --params-from <time_in_ISO_8601> \
      --params-to <time_in_ISO_8601> \
      --params-event-type <control_plane|data_plane> \
      --nebius-object-storage-bucket-by-id-id <bucket_ID> \
      --nebius-object-storage-object-prefix <prefix> \
      --params-filter "<filter_expression>"
   ```

   In the command above, specify:

   * `--parent-id`: Tenant ID that you copied earlier.
   * `--params-from`: Start time for the export, in the [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format.
   * `--params-to`: End time for the export, in the ISO 8601 format.
   * `--params-event-type` (optional): Type of audit event to export: `control_plane` or `data_plane`. Default: `control_plane`.
     * **Control plane events** (default): Track management operations on resources, such as creating, updating or deleting virtual machines, clusters or other infrastructure resources.
     * **Data plane events**: Track data access operations, such as reading or writing objects in Object Storage buckets.
   * `--nebius-object-storage-bucket-by-id-id`: Destination bucket ID that you copied earlier.
   * `--nebius-object-storage-object-prefix` (optional): Object prefix. If you omit it, the `auditlogs` prefix is used by default.
   * `--params-filter` (optional): Filter expression to narrow down exported events. For more information, see [How to filter audit events](./filter).

The command returns an operation that confirms the export was created. The export itself continues running in the background.

## How to check an export status

To check the current state and parameters of an export, get it by ID:

```bash theme={null}
nebius audit v2 audit-event-export get --id <export_ID>
```

Export lifecycle states include `RUNNING`, `DONE`, `FAILED` and `CANCELED`.

## How to list exports

To find a specific export, list all exports created for a tenant:

```bash theme={null}
nebius audit v2 audit-event-export list --parent-id <tenant_ID>
```

## How to download exported events

After an export reaches the `DONE` state, the exported audit events are available as objects in the destination bucket. To download these objects to your local machine for data portability or local storage:

1. [View the objects](/object-storage/objects/manage#how-to-view-objects) in the bucket to find the exported files. The objects are stored under the prefix that you specified when you launched the export, or under the default `auditlogs` prefix.

2. [Download the objects](/object-storage/objects/upload-download#how-to-download) from the bucket to your local machine. You can download a single object or all objects with a specific prefix.

   For example, to download all exported audit events with the default `auditlogs` prefix:

   ```bash theme={null}
   aws s3 cp --recursive \
       s3://<bucket_name>/auditlogs/<local/destination/path/>
   ```

## How to cancel an export

To stop an active export, run:

```bash theme={null}
nebius audit v2 audit-event-export cancel --id <export_ID>
```

The export transitions to the `CANCELED` state. Data that is already written to the bucket is preserved.