[Yandex Cloud documentation](../../../index.md) > [Yandex Object Storage](../../index.md) > [Tutorials](../index.md) > [Searching for events in audit logs](index.md) > Audit log management tools

# Tools for working with audit logs

# Tools for working with audit logs

You can upload audit logs to a [Yandex Object Storage](../../index.md) bucket, [Yandex Cloud Logging](../../../logging/index.md) log group, or data stream in [Yandex Data Streams](../../../data-streams/index.md).

Depending on the log location, you need to use different tools to view them and search for events:

* [Yandex Query](#tool-query)
* [Cloud Logging](#tool-logging)
* [jq](#tool-jq)

## Yandex Query {#tool-query}

Use [Query](../../../query/index.md) to work with logs uploaded to a bucket or a data stream:

* If logs reside in a bucket, you can use [analytical](../../../query/concepts/batch-processing.md) YQL queries to analyze Yandex Cloud resource events.
* If logs reside in a data stream, use [streaming](../../../query/concepts/stream-processing.md) YQL queries to analyze Yandex Cloud resource events.

To use Yandex Query, set up a data binding based on the target object:

{% list tabs group=instructions %}

* Object Storage bucket {#obj-storage}

    1. [Create a service account](../../../iam/operations/sa/create.md) named `bucket-yq-sa`.
    1. [Assign](../../../iam/operations/sa/assign-role-for-sa.md) the `bucket-yq-sa` service account the `storage.viewer` role for the folder containing the bucket with logs.
    1. Create a connection:

        1. In the [management console](https://console.yandex.cloud), select the folder containing the trail that delivers logs to the bucket.
        1. Navigate to **Audit Trails**.
        1. Select the trail that delivers logs to the bucket.
        1. Click **Process in YQ**.
        1. Select `bucket-yq-sa` **Service account**.
        1. Leave the other settings at their defaults.
        1. Click **Create**.

    1. In the window with data binding options, click **Create**.

    1. Run the appropriate [query](../../../audit-trails/tutorials/search-events-audit-logs/examples.md).

* Data Streams {#data-streams}

    1. [Create a service account](../../../iam/operations/sa/create.md) named `bucket-yq-sa`.
    1. [Assign](../../../iam/operations/sa/assign-role-for-sa.md) the `yds.editor` role to the `bucket-yq-sa` service account.
    1. [Create a connection](../../../query/operations/connection.md#create). Make sure to specify the settings for the **Data Streams** connection type.
    1. [Create a binding](../../../query/operations/binding.md).
    1. Run the appropriate [query](../../../audit-trails/tutorials/search-events-audit-logs/examples.md).

{% endlist %}

## Cloud Logging {#tool-logging}

Use [Cloud Logging](../../../logging/index.md) to work with logs uploaded to a log group.

You can filter logs using the [filter expression language](../../../logging/concepts/filter.md) to analyze Yandex Cloud resource events.

To use Cloud Logging:

1. [Read logs in the log group](../../../logging/operations/read-logs.md).
1. [Filter](../../../audit-trails/tutorials/search-events-audit-logs/examples.md) the logs as needed.

## jq {#tool-jq}

Use [jq](https://jqlang.github.io/jq/) to work with logs uploaded to a bucket.

Buckets store logs as JSON files. This means you can analyze Yandex Cloud resource events by retrieving the events you need from the files using `jq` [filters](https://jqlang.github.io/jq/manual/).

To use `jq`:

1. Install and set up [s3fs](../../tools/s3fs.md) or [goofys](../../tools/goofys.md) to mount Object Storage buckets using [FUSE](https://en.wikipedia.org/wiki/Filesystem_in_Userspace).

1. Mount a bucket with audit logs to your file system using [s3fs](../../tools/s3fs.md#mounting-bucket) or [goofys](../../tools/goofys.md#bucket-mounting).

1. Install [jq](https://stedolan.github.io/jq).

1. Run the [command](../../../audit-trails/tutorials/search-events-audit-logs/examples.md) with the relevant `jq` filter.

{% note info %}

Example commands for log operations use `jq` together with `find`, where `find` provides all log files from the bucket for processing.

{% endnote %}