Skip to main content
In this lesson you’ll configure audit log streaming for a GitHub Enterprise account and verify the streamed events in a third-party log service (Datadog). This demonstrates how administrative and repository activity is captured by GitHub and forwarded to external observability platforms for retention, alerting, and analysis. The Audit log view shows events generated by user and admin activity across organizations and enterprises.
A dark-themed GitHub Enterprise settings page for the "NextGen Gaming" organization showing the Audit log view with recent events, filters, and export buttons. The event list shows authorization and token-related entries (e.g., actions by "sid-dev2-kk").
What is Log Streaming?
  • GitHub Enterprise can forward audit events to supported destinations so you can centralize logs, run queries, create alerts, or retain data outside GitHub.
  • Supported destinations include cloud storage and observability tools such as Amazon S3, Google Cloud Storage, Azure Event Hubs, Datadog, and Splunk.
Open the Log streaming configuration in your Enterprise settings and choose a destination.
A dark-themed GitHub Enterprise settings page open to Audit log → Log streaming with a "Configure stream" dropdown expanded and "Azure Event Hubs" highlighted. The left sidebar shows other settings like General, Authentication security, and Hooks.
Streaming to Datadog — prerequisites
  • You need a Datadog API key and must select the Datadog site/region that matches your account (for example, use ap1.datadoghq.com for the AP1 region).
  • Create a clear name for the key (e.g., GitHub Logs) so you can identify it later.
To obtain the API key in Datadog:
  1. Open Datadog → Organization settings → API Keys.
  2. Create a new API key (name it like GitHub Logs).
  3. Copy the generated key and paste it into GitHub’s Log streaming configuration.
A Datadog web dashboard showing the Organization Settings → API Keys page with a "New API Key" modal open for "github-logs," the key partially visible and a tooltip saying "Copied to clipboard." The background shows the API keys list and the left-hand navigation menu.
Configure the Datadog stream in GitHub Enterprise
  • In the GitHub Log streaming UI:
    • Select Datadog as the destination.
    • Paste your Datadog API key.
    • Choose the Datadog site/region (for example, AP1 → ap1.datadoghq.com).
    • Use the “Validate endpoint” button so GitHub checks the token and site details.
    • Click Save to enable the stream.
It typically takes about 10–15 minutes for streamed audit logs to start appearing in Datadog after you enable the stream.
If you want configuration screenshots or step-by-step guidance for other destinations, GitHub provides per-destination instructions.
A screenshot of a GitHub Docs page titled "Setting up streaming to Datadog" showing numbered step-by-step instructions for configuring Datadog log streaming. The right side shows a table of contents with related audit log streaming topics.
Generate audit events to confirm streaming
  • After saving the stream, perform administrative and repository actions in your enterprise to generate events that will flow into Datadog. In this demo the following actions were performed:
    • Switched Advanced Security configuration from “NextGen Advanced Security” to “GitHub recommended” and then back.
    • Created an internal repository game-devstudio/test-repo-2 with a README.
    • Changed repository visibility to public.
    • Inspected deletion-related options in the repository “Danger Zone”.
    • Triggered secret scanning and waited for it to complete.
When GitHub asks for two-factor authentication (TOTP) during an admin action, provide the code as prompted. Example (one-time code shown for demonstration):
Exporting logs directly from GitHub
  • You can also request an on-demand export of audit logs (JSON or CSV). GitHub creates an export job and shows a message like:
  • Small accounts or low-volume activity often produce the export much sooner. Typical outputs are csv.gz or a JSON export file.
Sample UI audit entries
  • The Audit log UI displays concise entries with actor, action, repository, and timestamps. Example UI-style entries:
Sample streamed audit event (JSON)
  • Events streamed to destinations include rich metadata. Below is a representative JSON-style event as emitted to a streaming destination:
Verify events in Datadog
  • Once streaming is active and events are emitted, open Datadog’s Log Explorer and search for events like github.audit.streaming or filter by actor, action, repository, or other fields included in the JSON payload. The Log Explorer will show a timeline graph and a list of timestamped entries with searchable facets and attributes.
A Datadog Log Explorer screenshot showing a timeline graph at the top and a long list of timestamped "github.audit.streaming" log entries in the main pane. The left sidebar shows Datadog navigation and filter fields (Status, Activity ID, Actor details, etc.).
Quick checklist Links and references Summary
  • Configure Log streaming in GitHub Enterprise and select a supported destination (Datadog in this demo).
  • Generate an API key in Datadog and select the correct site/region.
  • Validate and save the stream; expect logs to appear in ~10–15 minutes.
  • Perform administrative and repository actions to generate audit events.
  • Verify and query those events in the destination (Datadog) and consult the destination provider’s documentation for service-specific setup, retention, and troubleshooting.

Watch Video