[Yandex Cloud documentation](../index.md) > [Yandex BareMetal](index.md) > Concepts > Setup and management > Audit Trails events > Overview

# Yandex Audit Trails event reference

Audit Trails supports tracking [control plane](../audit-trails/concepts/format.md) (management) and [data plane](../audit-trails/concepts/format-data-plane.md) (data) events for Yandex BareMetal.

The general format of the `event_type` field value is as follows:

```text
yandex.cloud.audit.baremetal.<event_name>
```

You can find the detailed JSON structure of the event record in the audit log reference. The events in it are sorted alphabetically without division into levels and contain all possible fields. In real logs, the field set depends on the parameters of the event and particular object.

## Management event reference {#control-plane-events}

Event name | Description
--- | ---
`ApplyUpdatePrivateCloudConnection` | Applying updates to a private connection to subnets in a VPC or on-prem infrastructure
`BatchCreateServer` | Renting several BareMetal [servers](concepts/servers.md) at the same time
`CreateImage` | Creating a boot image
`CreatePrivateCloudConnection` | Creating a [private connection](concepts/private-network.md#private-connection-to-vpc) to subnets in a VPC or on-prem infrastructure
`CreatePrivateSubnet` | Creating a [private subnet](concepts/private-network.md#private-subnet)
`CreatePublicPrefixPool` | Creating a public prefix pool
`CreatePublicSubnet` | Creating a [public subnet](concepts/public-network.md)
`CreateServer` | BareMetal server rent
`CreateVRF` | Creating a [virtual network segment](concepts/private-network.md#vrf-segment) (VRF)
`DeleteImage` | Deleting a boot image
`DeletePrivateCloudConnection` | Deleting a private connection to subnets in a VPC or on-prem infrastructure
`DeletePrivateSubnet` | Deleting a private subnet
`DeletePublicPrefixPool` | Deleting a public prefix pool
`DeletePublicSubnet` | Deleting a public subnet
`DeleteServer` | Completely removing the BareMetal server, wiping disks and all user data
`DeleteVRF` | Deleting a virtual network segment (VRF)
`PowerOffServer` | Powering off a BareMetal server
`PowerOnServer` | Powering on a BareMetal server
`RebootServer` | Restarting a BareMetal server
`RegisterServerBackupAgent` | Registering a Yandex Cloud Backup [agent](../backup/concepts/agent.md) on a BareMetal server
`ReinstallServer` | Reinstalling a BareMetal server OS
`StartServerProlongation` | Enabling auto-renewal of BareMetal server lease
`StopServerProlongation` | Disabling auto-renewal of BareMetal server rent
`UpdateImage` | Updating a boot image
`UpdatePrivateCloudConnection` | Updating a private connection to subnets in a VPC or on-prem infrastructure
`UpdatePrivateSubnet` | Updating a private subnet
`UpdatePublicPrefixPool` | Updating a public prefix pool
`UpdatePublicSubnet` | Updating a public subnet
`UpdateServer` | Updating a BareMetal server
`UpdateVRF` | Updating a virtual network segment (VRF)

## Data event reference {#data-plane-events}

Event name | Description
--- | ---
`flowlogs.ExternalFlow` | Traffic flow from BareMetal servers to external networks

### flowlogs.ExternalFlow event {#external-flow}

The `flowlogs.ExternalFlow` event contains aggregate information about BareMetal server traffic streams to external networks.

{% note warning %}

`ExternalFlow` events are sampled from every 1,000th packet and aggregated for a five-minute interval.

{% endnote %}

The `details` object of a `flowlogs.ExternalFlow` event contains the following fields:

#|
|| Field | Type | Description ||
|| `vers` | int64 | IP version: `4` for IPv4 or `6` for IPv6 ||
|| `proto` | int64 | Transport protocol [IANA](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml) number, e.g., `6` for TCP or `17` for UDP ||
|| `srcAddr` | string | Source IP address ||
|| `dstAddr` | string | Destination IP address ||
|| `direction` | string | Traffic direction, with `INGRESS` for incoming traffic and `EGRESS` for outgoing traffic ||
|| `srcPort` | int64 | Source port ||
|| `dstPort` | int64 | Destination port ||
|| `aggStart` | timestamp | Aggregation period start time in [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format ||
|| `aggEnd` | timestamp | Aggregation period end time in [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format ||
|| `packets` | int64 | Number of packets for the aggregation period ||
|| `bytes` | int64 | Number of bytes for the aggregation period ||
|| `tcpFlags` | string | TCP flags in hex format, e.g., `0x02` ||
|| `subnetId` | string | Subnet ID ||
|| `folderId` | string | Folder ID ||
|#