---
title: About MAAS events
description: Canonical makes open source secure, reliable and easy to use, providing
  support for Ubuntu and a portfolio of enterprise-grade technologies. Founded in
  2004, Canonical operates globally with team members in over 80 countries.
url: https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md
---

*Submit*

# About MAAS events

Events in MAAS record what’s happening inside the system — from machine state changes to user actions and configuration updates. Understanding them helps you:

* Debug commissioning and deployment issues.
* Verify that operations completed as expected.
* Maintain an audit trail for compliance and governance.

Events can be triggered by:

* Internal processes (e.g., a machine moving from commissioning to testing).
* External conditions (e.g., a controller restarting).
* User actions (e.g., acquiring or deleting a machine).

## [Ways to view events](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-ways-to-view-events)

You can explore events in three different ways, depending on how much detail you need:

* MAAS logs (raw detail)
  Directly from the file system, with full context. Best for deep troubleshooting.
* CLI `events query` command (structured JSON)
  A quick way to filter and script against event data.
* UI Event Log (summary view)
  A user-friendly log of major events, easy to read at a glance.

## [Examples](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-examples)

For a machine called `fun-zebra`:

Log file (`maas.log`)

```
maas.log:2022-09-29T15:04:07.795515-05:00 neuromancer maas.node: [info] fun-zebra: Status transition from COMMISSIONING to TESTING
maas.log:2022-09-29T15:04:17.288763-05:00 neuromancer maas.node: [info] fun-zebra: Status transition from TESTING to READY
```

CLI output (`events query`)

```
{
    "username": "unknown",
    "node": "bk7mg8",
    "hostname": "fun-zebra",
    "id": 170,
    "level": "INFO",
    "created": "Thu, 29 Sep. 2022 20:04:17",
    "type": "Ready",
    "description": ""
},
{
    "username": "unknown",
    "node": "bk7mg8",
    "hostname": "fun-zebra",
    "id": 167,
    "level": "INFO",
    "created": "Thu, 29 Sep. 2022 20:04:07",
    "type": "Running test",
    "description": "smartctl-validate on sda"
}
```

UI event log

| Time | Event |
| --- | --- |
| Thu, 29 Sep. 2022 20:04:17 | Node changed status – From *Testing* to *Ready* |
| Thu, 29 Sep. 2022 20:04:07 | Node changed status – From *Commissioning* to *Testing* |

## [About audit events](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-about-audit-events)

In addition to standard events, MAAS generates audit events (`AUDIT` level) that focus on:

* Machine lifecycle changes (commissioning, deployment, deletion).
* User activity (logins, role changes, configuration edits).
* System settings (DHCP snippets, scripts, and more).

Audit logs are especially valuable for:

* Compliance and governance.
* Tracing historical changes.
* Reconstructing the timeline of a problem.

## [Working with audit events](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-working-with-audit-events)

### [Fetch audit events](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-fetch-audit-events)

```
# Get all audit logs
maas $PROFILE events query level=AUDIT

# Get the latest 20
maas $PROFILE events query level=AUDIT limit=20 after=0
```

### [Parse the output](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-parse-the-output)

Audit logs are JSON, so you can pipe into `jq`:

```
maas $PROFILE events query level=AUDIT | jq -r '.events[] | {username, node, description}'
```

For simpler parsing, standard UNIX text tools (`grep`, `cut`, `sort`, `sed`) also work.

### [Typical structure](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-typical-structure)

Audit events usually follow a verb–noun pattern:

* `Started testing on 'example-node'`
* `Marked 'old-node' broken`
* `Deleted the machine 'retired-system'`

### [Filtering](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-filtering)

Narrow results by hostname or username:

```
# Show audit events for one machine
maas $PROFILE events query hostname=my-node

# Show delete actions by a user
maas $PROFILE events query username=jane level=AUDIT | grep "Deleted "
```

Filters can be combined for precise queries.

## [Summary](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-summary)

* Events show what’s happening inside MAAS.
* Audit events add accountability and history.
* Logs, CLI, and UI each give a different perspective — pick the one that fits your need.
* Filtering and parsing make large event sets manageable.

## [Next steps](https://canonical-com-2950.demos.haus/maas/docs/about-maas-events?format=md#p-13512-next-steps)

* Discover [how to use logging](https://canonical.com/maas/docs/how-to-use-logging)
* Scan the [MAAS logging reference](https://canonical.com/maas/docs/maas-logging-reference) to discover the various types of logs available in MAAS

---

[Previous

Performance](https://canonical-com-2950.demos.haus/maas/docs/about-maas-performance)
[Next

Logging](https://canonical-com-2950.demos.haus/maas/docs/about-maas-logging)

Last updated 1 year, 1 month ago. [Help improve this document in the forum](https://discourse.maas.io/t/about-maas-events/6510).