A stream defines how log data is collected, batched, and delivered to a destination. Streams operate in near real time, gathering events from supported services and sending them to the destination you've configured.

Once a stream is created, it automatically delivers log data for all supported services in your account. There is no need to create separate streams for each service.

Supported stream types

audit_logs. Audit logs collect and deliver configuration and login audit events. To learn more about audit logs, see Log files.

📘

audit_logs is currently the only supported stream type. Additional log types are planned for future releases.

Prerequisites

Before creating a stream, ensure that:

Stream attributes

A stream has the following attributes:

  • Name. A unique name for the stream. Stream creation will fail if the name already exists.

  • Type. The category of data the stream collects. Currently, only audit_logs is supported.

  • Destination. The destination that receives the batched logs collected by the stream. See Destinations for more information. Destination includes destination type and name.

Stream activation

When a stream is created, it's active by default. You can activate or deactivate at any time by selecting Activate or Deactivate from the stream's options menu.

  • Active: The stream is fully enabled and will begin collecting and sending audit logs to its destination.
  • Inactive: The stream is defined but no longer active. It is not delivering logs.
  • Provisioning: Backend resources are being set up. Log delivery does not begin until a stream is active.

📘

After a stream becomes active, it may take up to 45 minutes for logs to begin arriving at the destination.

Stream versions

Each time you create or update a stream—for example, when you modify its settings or change the destination—a new version is generated. Versioning provides visibility and traceability for long-lived or frequently updated streams.

Versioning behaves as follows:

  • Previous versions are retained
  • The version with the highest version number is the active version
  • You can retrieve a stream's version history to examine past configurations and see how the configuration has changed over time

Managing streams

You can configure and manage streams using either Cloud Manager or the Linode API.

  • Cloud Manager provides a guided, UI-based workflow for creating and editing streams. For step-by-step instructions, see Manage Streams.
  • The Linode API offers full programmatic control. To learn the basics of configuring a stream using the Linode API, see this workflow.

Deleted streams

When a stream configuration is deleted, audit events continue to be generated in your account but will no longer be delivered to any destination. Settings and credentials aren't retained when a stream configuration is deleted.