ACL-LOG(3valkey)

📦
version 9.0.6 · 2 versions
, in fedora 44

💅 ACL-LOG — the Valkey manual, but make it gossip

okay bestie, welcome to the Valkey Command Manual entry for acl-log, straight out of the 3valkey manual section. pull up a chair, grab a boba, we're gonna read this thing together 🍓

✨ NAME ✨

acl-log — Lists recent security events generated due to ACL rules.

like, it's the receipts folder for your ACL drama. 🕵️♀️

🌸 SYNOPSIS 🌸

ACL LOG [count | RESET]

💖 DESCRIPTION 💖

The command shows a list of recent ACL security events:

  1. Failures to authenticate their connections with valkey-auth(7) AUTH or valkey-hello(7) HELLO.
  2. Commands denied because against the current ACL rules.
  3. Commands denied because accessing keys not allowed in the current ACL rules.

The optional argument specifies how many entries to show. By default up to ten failures are returned. The special RESET argument clears the log. Entries are displayed starting from the most recent.

so basically: someone tried to sneak in with a bad password? logged. someone ran a command they had no business running? logged. someone tried to touch a key that is not theirs? logged, logged, logged. no cap, the server is a snitch and honestly? good for her. 💅

and the tea is served freshest-first — newest entries at the top, always. 🔥

👑 REPLY 👑

When called to show security events:

When called with RESET:

⭐ COMPLEXITY ⭐

O(N) with N being the number of entries shown.

🌈 ACL CATEGORIES 🌈

@admin @dangerous @slow

🦋 HISTORY 🦋

  • Available since: 6.0.0
  • Changed in 7.2.0: Added entry ID, timestamp created, and timestamp last updated.

glow-up timeline fr fr ✨

🎀 EXAMPLES 🎀

127.0.0.1:6379> AUTH someuser wrongpassword
(error) WRONGPASS invalid username-password pair
> ACL LOG 1
1)  1) "count"
    2) (integer) 1
    3) "reason"
    4) "auth"
    5) "context"
    6) "toplevel"
    7) "object"
    8) "AUTH"
    9) "username"
   10) "someuser"
   11) "age-seconds"
   12) "8.038"
   13) "client-info"
   14) "id=3 addr=127.0.0.1:57275 laddr=127.0.0.1:6379 fd=8 name= age=16 idle=0 flags=N db=0 sub=0 psub=0 ssub=0 multi=-1 qbuf=48 qbuf-free=16842 argv-mem=25 multi-mem=0 rbs=1024 rbp=0 obl=0 oll=0 omem=0 tot-mem=18737 events=r cmd=auth user=default redir=-1 resp=2"
   15) "entry-id"
   16) (integer) 0
   17) "timestamp-created"
   18) (integer) 1675361492408
   19) "timestamp-last-updated"
   20) (integer) 1675361492408

Each log entry is composed of the following fields:

  1. count: The number of security events detected within a 60 second period that are represented by this entry.
  2. reason: The reason that the security events were logged. Either command, key, channel, or auth.
  3. context: The context that the security events were detected in. Either toplevel, multi, lua, or module.
  4. object: The resource that the user had insufficient permissions to access. auth when the reason is auth.
  5. username: The username that executed the command that caused the security events or the username that had a failed authentication attempt.
  6. age-seconds: Age of the log entry in seconds.
  7. client-info: Displays the client info of a client which caused one of the security events.
  8. entry-id: The sequence number of the entry (starting at 0) since the server process started. Can also be used to check if items were "lost", if they fell between periods.
  9. timestamp-created: A UNIX timestamp in milliseconds at the time the entry was first created.
  10. timestamp-last-updated: A UNIX timestamp in milliseconds at the time the entry was last updated.

ngl field 7 is the one that really spills the tea — that client-info blob is a whole personality profile of whoever did the crime 😭 and entry-id is your detective tool for spotting gaps, like "wait, where did entry go…"

🫶 little heads-up bestie: those "lost" items thing in entry-id is literally in the docs — if entries fell between periods, the sequence number is how you catch it.

💜 SEE ALSO 💜

acl(3valkey), acl-cat(3valkey), acl-deluser(3valkey), acl-dryrun(3valkey), acl-genpass(3valkey), acl-getuser(3valkey), acl-help(3valkey), acl-list(3valkey), acl-load(3valkey), acl-save(3valkey), acl-setuser(3valkey), acl-users(3valkey), acl-whoami(3valkey), bgrewriteaof(3valkey), bgsave(3valkey), command(3valkey), command-count(3valkey), command-docs(3valkey), command-getkeys(3valkey), command-getkeysandflags(3valkey), command-help(3valkey), command-info(3valkey), command-list(3valkey), commandlog(3valkey), commandlog-get(3valkey), commandlog-help(3valkey), commandlog-len(3valkey), commandlog-reset(3valkey), config(3valkey), config-get(3valkey), config-help(3valkey), config-resetstat(3valkey), config-rewrite(3valkey), config-set(3valkey), dbsize(3valkey), debug(3valkey), failover(3valkey), flushall(3valkey), flushdb(3valkey), info(3valkey), lastsave(3valkey), latency(3valkey), latency-doctor(3valkey), latency-graph(3valkey), latency-help(3valkey), latency-histogram(3valkey), latency-history(3valkey), latency-latest(3valkey), latency-reset(3valkey), lolwut(3valkey), memory(3valkey), memory-doctor(3valkey), memory-help(3valkey), memory-malloc-stats(3valkey), memory-purge(3valkey), memory-stats(3valkey), memory-usage(3valkey), module(3valkey), module-help(3valkey), module-list(3valkey), module-load(3valkey), module-loadex(3valkey), module-unload(3valkey), monitor(3valkey), psync(3valkey), replconf(3valkey), replicaof(3valkey), restore-asking(3valkey), role(3valkey), save(3valkey), shutdown(3valkey), slowlog(3valkey), slowlog-get(3valkey), slowlog-help(3valkey), slowlog-len(3valkey), slowlog-reset(3valkey), swapdb(3valkey), sync(3valkey), time(3valkey)

and that's the whole page, bestie — every flag, every field, every sibling command, all intact. you understood it, you're basically an ACL girlie now. periodt 💅✨

version 9.0.0, dated 2025-10-21 — that's the ACL-LOG(3valkey) page, signed, sealed, slayed. 🎀🦋

📦 where this page comes from