> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zylon.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log

> Configure gateway chat-content capture, internal log storage, and external delivery.

<Warning>
  **Upcoming release — Zylon 1.58**

  These docs are published ahead of release so you can prepare your API integrations. The release image is not yet available. For installations running 1.57, use the [1.57 documentation](/en/v1.57/overview).
</Warning>

`features.audit.enabled` controls whether gateway chat logs capture request messages and response content. It is enabled by default. Workspace, Backoffice, and security events are still emitted when this flag is disabled.

Chat-content capture, internal storage, and external delivery are separate settings. Storage is enabled by default; syslog and HTTP delivery are disabled by default.

### Configuration

| Key | Default | Values | Description |
| - | - | - | - |
| `features.audit.enabled` | `true` | `true`, `false` | Captures request messages and response content in gateway chat logs. |
| `logging.storage.enabled` | `true` | `true`, `false` | Persists structured logs internally for later retrieval. |
| `logging.delivery.syslog.enabled` | `false` | `true`, `false` | Sends newly emitted logs to a syslog collector. |
| `logging.delivery.http.enabled` | `false` | `true`, `false` | Sends newly emitted logs to an HTTP collector. |

### Example

This example enables gateway chat-content capture and internal storage:

```yaml theme={null}
features:
  audit:
    enabled: true

logging:
  storage:
    enabled: true
```

For CLI-managed installations, merge these settings into `/etc/zylon/zylon-conf.yaml` and run `sudo zylon-cli sync`.

<Note>
  Captured chat content can appear in stored logs and externally delivered records. Set `features.audit.enabled: false` to omit gateway chat request messages and response content. This flag does not provide general redaction of every event field. The Backoffice API's `include` parameter controls retrieval only; it does not filter externally delivered records.
</Note>

To connect a SIEM, follow [Send logs to your SIEM](/en/v1.58/operator-manual/configuration/features/log-delivery-storage#send-logs-to-your-siem). To schedule deletion of stored logs, see [Log-only cleanup](/en/v1.58/operator-manual/configuration/features/log-delivery-storage#configure-cleanup-for-stored-logs-only). Enabling the example above alone does not forward logs externally or enable cleanup.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.