# Audit Log Report Command

### Audit Log

This command/function helps to exports Keeper enterprise audit events to external systems or local files. It supports record-backed configuration and incremental export state, similar to Python Commander.

<details>

<summary>DotNet CLI</summary>

**coming soon**

</details>

<details>

<summary>DotNet SDK</summary>

Comming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command:** `Export-KeeperAuditLog`

**Alias:** `kal`

**Parameter:**

* `-Target` Export destination: `json`, `syslog`, `splunk`, `sumo`, `azure-la`, `syslog-port`
* `-Record` Keeper record title or UID used to store export configuration and incremental state
* `-FilePath` Output file path for `json` and `syslog`
* `-Url` Endpoint URL for `splunk` and `sumo`
* `-Token` Splunk HEC token, Required for splunk.
* `-SyslogHost` Remote syslog server host for `syslog-port`
* `-SyslogPort` Remote syslog server port for `syslog-port` t
* `-SyslogProtocol` `tcp` or `udp` for `syslog-port`
* `-UseSsl` Use TLS for `syslog-port` over TCP
* `-OctetCounting` Use RFC 5425 framing for `syslog-port`
* `-WorkspaceId` Azure Log Analytics workspace ID
* `-WorkspaceKey` Azure Log Analytics workspace key
* `-SharedFolderUid` Filter by shared folder UID
* `-NodeId` Filter by enterprise node ID
* `-Days` Export only events from the last N days
* `-LastEventTime` Resume export from a previous Unix timestamp
* `-Anonymize` Replace usernames and emails with enterprise user IDs
* `-IgnoreCertificateErrors` Ignore certificate validation errors for `splunk`, `sumo`, and `azure-la`

**Examples:**

{% code overflow="wrap" %}

```powershell
PS > Export-KeeperAuditLog -Target json -FilePath "audit_events.json" -Days 7
Exported 4271 audit event(s).                                                                                 

ExportedCount LastEventTime Target Success
------------- ------------- ------ -------
         4271    1774947466 json      True
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

Comming Soon

</details>

<details>

<summary>Python SDK</summary>

Comming Soon

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/reporting-commands/audit-log-report-command.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.