# ACL LOG

> Show or clear the recent commands, keys and channels the ACL denied, and failed logins.

URL: https://docs.hotkv.com/commands/acl-log/

```
ACL LOG [count | RESET]
```

- Group: ACL
- Complexity: O(N) where N is the number of entries returned
- HotKV Cloud: all plans
- On-Premise: no license needed

`ACL LOG` shows the most recent security events, newest first: commands a
user was not allowed to run, keys and channels it was not allowed to touch,
and failed [AUTH](https://docs.hotkv.com/commands/auth/index.md) attempts. Without an argument it returns
up to 10 entries; `count` sets how many. `ACL LOG RESET` clears the log.

The same denial repeated within a minute (same reason, context, object and
user) is counted on its existing entry instead of adding a new one. The log
keeps up to `acllog-max-len` entries (128 by default).

## Return value

`RESET` replies `OK`. Otherwise an array of entries, newest first; each entry
is a map in RESP3 and a flat array of pairs in RESP2:

| Field | Meaning |
| --- | --- |
| `count` | How many times this event happened |
| `reason` | `command`, `key`, `channel` or `auth` |
| `context` | Where it happened: `toplevel`, `multi` (inside a transaction) or `lua` (inside a script) |
| `object` | The command, key or channel denied (for `auth`, the context of the login) |
| `username` | The user involved |
| `age-seconds` | Seconds since the entry was created (a double; a bulk string in RESP2) |
| `client-info` | The client, in the [CLIENT LIST](https://docs.hotkv.com/commands/client-list/index.md) format, at its latest occurrence |
| `entry-id` | A number that identifies the entry |
| `timestamp-created` | Unix time in milliseconds when it was first logged |
| `timestamp-last-updated` | Unix time in milliseconds of its latest occurrence |

A negative `count` returns no entries. A `count` that is not an integer
replies `ERR value is not an integer or out of range`.

## Examples

```
127.0.0.1:6379> AUTH reports wrong-password
(error) WRONGPASS invalid username-password pair or user is disabled.
127.0.0.1:6379> ACL LOG 1
1)  1) "count"
    2) (integer) 1
    3) "reason"
    4) "auth"
    5) "context"
    6) "toplevel"
    7) "object"
    8) "AUTH"
    9) "username"
   10) "reports"
   11) "age-seconds"
   12) "4.21"
   13) "client-info"
   14) "id=12 addr=127.0.0.1:53214 laddr=127.0.0.1:6379 fd=9 name= age=31 idle=0 flags=N db=0 sub=0 psub=0 ssub=0 multi=-1 watch=0 qbuf=0 qbuf-free=0 argv-mem=0 multi-mem=0 rbs=0 rbp=0 obl=0 oll=0 omem=0 tot-mem=0 events=r cmd=auth user=default redir=-1 resp=2 lib-name= lib-ver="
   15) "entry-id"
   16) (integer) 0
   17) "timestamp-created"
   18) (integer) 1790851002318
   19) "timestamp-last-updated"
   20) (integer) 1790851002318
127.0.0.1:6379> ACL LOG RESET
OK
```

## Compatibility

Same fields, order and `RESET` as Redis 7 and Valkey 8.

## See also

[ACL SETUSER](https://docs.hotkv.com/commands/acl-setuser/index.md), [ACL DRYRUN](https://docs.hotkv.com/commands/acl-dryrun/index.md),
[AUTH](https://docs.hotkv.com/commands/auth/index.md)