Fix audit log streaming filename format - #45787
Conversation
github-actions
Bot
added
the
triage
How to review these changes 👓Thank you for your contribution. To review these changes, choose one of the following options: A Hubber will need to deploy your changes internally to review. Table of review linksNote: Please update the URL for your staging server or codespace. The table shows the files in the
Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server 🤖 This comment is automatically generated. |
There was a problem hiding this comment.
🟡 Changes recommended
The format was verified only for Enterprise Cloud with Amazon S3 but is documented as universal.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Corrects the documented audit-log filename format.
Changes:
- Adds the missing day path segment.
- Changes the extension to
.json.log.gz.
File summaries
| File | Description |
|---|---|
streaming-the-audit-log-for-your-enterprise.md |
Updates the streamed audit-log filename format. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| You can set up{% ifversion pause-audit-log-stream %}, pause,{% endif %} or delete a stream at any time. The stream exports audit and Git events data for all of the organizations in your enterprise, for activity from the time the stream is enabled onwards. | ||
|
|
||
| All streamed audit logs are sent as compressed JSON files. The filename format is in`YYYY/MM/HH/MM/<uuid>.json.gz`. | ||
| All streamed audit logs are sent as compressed JSON files. The filename format is `YYYY/MM/DD/HH/MM/<uuid>.json.log.gz`. |
Why:
Closes: N/A
The documented filename format for streamed audit logs is incorrect in two ways:
DD) segment. Actual objects are written under a five-levelyear/month/day/hour/minuteprefix..json.log.gz, not.json.gz.I verified this with GitHub Enterprise Cloud audit log streaming to Amazon S3 (September 2026).
Note: I have not been able to verify the behavior on GitHub Enterprise Server or with other streaming destinations, so please let me know if a version- or provider-specific distinction is needed👍
What's being changed (if available, include any code snippets, screenshots, or gifs):
This corrects the filename format described in Streaming the audit log for your enterprise.
Check off the following:
Thank you😀