[Home](https://help.qlik.com/en-US/cloud-admin-playbook/Content/home.htm) > [System spot check](https://help.qlik.com/en-US/cloud-admin-playbook/Content/system_spot_check.htm) > Monitor system events

# Monitor system events

**Cadence:** Daily

**Subscription model:** All

**Roles:** Tenant Admin (TA), Analytics Admin (AA—Home dashboard only), Data Admin (DA—Home dashboard only)

**Last verified:** 2026-09

|  | Initial | Recurring |
| --- | --- | --- |
| **Estimated time** | 10 min | 5 min |

**Benefits:**

* Same-day visibility into security events, failures, and suspicious activity
* Provides a tenant-wide snapshot of consumption in one screen
* Captures events older than 90 days, accessible only via the Audits API archive endpoint—daily review keeps the live window short

***

## Goal

Open the **Home** dashboard in the admin console for a subscription / consumption snapshot, and the **Events** page for the audit log. The Events page is filterable by event type. Live events from the past 90 days are accessible via the Events page (and the **Audits API** at `/api/v1/audits`); after 90 days, events are archived but remain accessible for the lifetime of the tenant via `/api/v1/audits/archive`.

## Tasks

| Task | TA | AA | DA | AuA |
| --- | --- | --- | --- | --- |
| Review the admin console **Home** dashboard for capacity / consumption alerts | ✓ | ✓ | ✓ |  |
| Review Events page and filter for failures, security events, suspicious API key activity | ✓ |  |  |  |
| For long-horizon SIEM retention, build a daily pull against `/api/v1/audits/archive`—note that the archive endpoint accepts a single `date=` parameter (no range), so >90-day retention pipelines must iterate per-day | ✓ |  |  |  |

## Read before acting—gotchas

* **Legacy IAM system events are being retired.** `com.qlik.*` events for auth, users, groups, roles, tenants, web integrations, spaces, and OAuth clients will be removed **on or after November 30, 2026**, replaced by namespaced `com.qlik.core.*` events. Any `eventType` filter built against the old event names on `/api/v1/audits` breaks on that date—re-test filters before then. See the [Qlik release notes and deprecation notices](https://help.qlik.com/en-US/cloud-admin-playbook/Content/tenant_configuration/review_release_changes.htm#references).

## Automation helpers

* **Adjacent only**—Qlik publishes an Automate template that exports audit logs from **Qlik Replicate / Qlik Enterprise Manager** (a separate on-premises product line) into Splunk. For Qlik Cloud audits there is no first-party template; write your own daily pull against `/api/v1/audits/archive` and forward to your SIEM.

## References

* [Monitoring system events](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/mc-administer-events.htm)
* [Audits REST API (qlik.dev)](https://qlik.dev/apis/rest/audits/)
* [Accessing the Administration activity center](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/management-console.htm)

**Tags:** `#daily` `#system_spot_check` `#events` `#audits_api` `#security`