Skip to content
Cloud Provider Benchmarks

Benchmarks

Cloud audit logging compared: vTrail, CloudTrail, Azure Activity Log and Cloud Audit Logs

Cloud audit logging answers who performed which API operation, on what resource, from where and with what result. This page compares audit services on documented features and maps their event fields to a common conceptual model. PortvMind vTrail details are supplied by the provider team and are marked as such.

Updated:

Direct answer

A useful cloud audit trail records event time, request ID, method and path, outcome, caller IP and user agent, authenticated user and project, and the target service. AWS CloudTrail, Azure Activity Log and Google Cloud Audit Logs document these for control-plane operations; PortvMind vTrail records them at the API gateway, with search, retention and export not yet publicly documented.

What is measured

  • Event scope (control plane, data plane)
  • Identity attribution and request metadata
  • Search, retention, export and integrity features

Audit service features

Detailed comparison →
Documented features of cloud audit logging services
Feature vTrail PortvMind Cloud AWS CloudTrail Amazon Web Services Azure Monitor Activity Log Microsoft Azure Cloud Audit Logs Google Cloud
Control-plane audit scope Records management operations (create, modify, delete) performed through the API or console. Yes Cloud management API operations. Yes Management events recorded by default. Yes Azure Resource Manager write/delete/action operations. Yes Admin Activity logs always enabled.
Identity attribution Identifies the authenticated user, project/account and scope behind each operation. Yes User ID, user name, project ID and auth scope. Yes userIdentity block (principal, account, session). Yes Caller and claims. Yes authenticationInfo.principalEmail.
Request metadata Captures request ID, HTTP method, path, status code, source IP and user agent. Yes Request ID, HTTP method, path, status, client IP, user agent, request time. Yes eventTime, requestID, sourceIPAddress, userAgent, errorCode. Partial Correlation ID, operation, status and caller IP in HTTP request details where available. Yes requestMetadata.callerIp and callerSuppliedUserAgent; status.
Data-plane (data access) events Optional recording of data-level reads and writes (for example object reads). Unverified Yes Data events (for example S3 object-level) are optional and charged. Partial Via resource logs and diagnostic settings, not the Activity Log itself. Yes Data Access logs, mostly disabled by default.
Event search and filtering Console or API search by user, time range, resource or operation. Unverified Yes Event history lookup; SQL queries in CloudTrail Lake. Yes Portal filtering and Log Analytics (KQL). Yes Logs Explorer and Log Analytics.
Configurable retention Documented default retention and options to extend it. Unverified Yes 90-day event history; longer retention via trails to S3 or CloudTrail Lake. Yes 90 days in the platform; longer through Log Analytics or Storage. Yes Admin Activity retained 400 days in _Required; other buckets configurable.
Export and streaming Delivery to object storage, log analytics or SIEM pipelines. Unverified Yes S3, CloudWatch Logs, EventBridge. Yes Diagnostic settings to Log Analytics, Storage and Event Hubs. Yes Sinks to Cloud Storage, BigQuery and Pub/Sub.
Log integrity validation Cryptographic or immutability controls that detect tampering. Unverified Yes Log file integrity validation with digest files. Partial Immutable storage policies on the export destination. Partial Locked log buckets prevent retention changes.
Pricing model Whether baseline audit history is included and how extended capabilities are charged. Unverified Yes Event history and one copy of management events free; data events and Lake charged. Yes 90-day Activity Log included; ingestion into Log Analytics is charged. Yes Admin Activity at no charge; Data Access ingestion charged beyond free allotment.
Information source Supplied by provider team Official documentation Official documentation Official documentation

Providers whose audit-logging capabilities have not been assessed: DigitalOcean, Vultr, Hetzner. Their values are treated as unverified until documented.

Conceptual audit event model

Common fields and their counterparts in other providers’ documented event schemas. Fields without a direct equivalent are shown as —.

Conceptual cloud audit event data model For research documentation; does not represent production audit records.
Field Type Description AWS CloudTrail Google Cloud Audit Logs OpenStack CADF
event_time string (RFC 3339) When the operation was received, in UTC. eventTime timestamp eventTime
request_id string Unique request identifier used to correlate gateway, service and resource logs. requestID insertId / operation.id id / requestId (attachment)
http_method string HTTP verb of the API call (GET, POST, PUT, PATCH, DELETE). — httpRequest.requestMethod action (mapped)
full_path string Requested API path, identifying the target resource. eventSource + eventName protoPayload.methodName / resourceName target.id / requestPath
http_status integer Response status code — the outcome of the operation. errorCode (on failure) protoPayload.status.code outcome / reason.reasonCode
client_ip string (IP) Source IP address of the caller. sourceIPAddress protoPayload.requestMetadata.callerIp initiator.host.address
user_agent string Client software (console, CLI, SDK, Terraform). userAgent protoPayload.requestMetadata.callerSuppliedUserAgent initiator.host.agent
auth_user_id string Stable identifier of the authenticated user. userIdentity.principalId protoPayload.authenticationInfo.principalSubject initiator.id
auth_user_name string Human-readable user name at the time of the request. userIdentity.userName / arn protoPayload.authenticationInfo.principalEmail initiator.name
auth_project_id string Project (tenant) the token was scoped to. recipientAccountId resource.labels.project_id initiator.project_id
auth_scope string Authorisation scope or role context of the token. userIdentity.sessionContext protoPayload.authorizationInfo initiator.credential
service_id string Backend cloud service that handled the request (compute, network, storage). eventSource protoPayload.serviceName observer.id / target.typeURI
route_id string API gateway route that matched the request. — — —
request_time number (ms) End-to-end request processing time. — httpRequest.latency —
Empty template (JSON)
{
  "event_time": "",
  "request_id": "",
  "http_method": "",
  "full_path": "",
  "http_status": null,
  "client_ip": "",
  "user_agent": "",
  "auth_user_id": "",
  "auth_user_name": "",
  "auth_project_id": "",
  "auth_scope": "",
  "service_id": "",
  "route_id": "",
  "request_time": null
}