# Auditty

> Auditty forwards the 5% of your logs that matter and keeps 100% of the raw data in your own cloud storage, then proves nothing was lost.

Auditty is an AI data engine for Kubernetes logs. It runs as a
DaemonSet, classifies every container log line on the node before it leaves the
cluster, forwards only the lines that carry information to your existing SIEM or
log vendor, and writes 100% of the raw stream, compressed and indexed, to your own
cloud storage bucket. Suppressed lines are never destroyed and can be retrieved
on demand by pattern, time range or field value.

Key properties:

- Logs are filtered in place on the node. The container runtime is unaware of it, existing log shippers need no change, and nothing is inserted into the network path.
- The agent uses 60 to 80 MB per node in steady state, under an enforced ceiling of 768 MiB and 1.5 vCPU per node that is a real limit rather than a recommendation. It is not a privileged container: it runs with two scoped Linux capabilities, DAC_READ_SEARCH and SYS_PTRACE.
- Added latency to applications is zero: processing happens after the line has been written and never blocks the process that wrote it.
- Suppression requires no configuration: a pattern must prove itself genuinely repetitive before being summarised, something merely widespread across many pods is treated as telemetry rather than noise, and errors and warnings are never suppressed by it. Rules are optional and exist to scope which workloads are read and to override the automatic decision.
- Only masked templates, counts and metadata reach the control plane, and this holds for anomalies as well as for the steady state: an anomaly signal carries the pattern's template and its rates, not a sample of the log. Raw lines and the values extracted from them stay in the customer's own bucket, read only when the customer requests a retrieval.
- Auditty holds no credentials for customer cloud storage and has no network path to it.
- Rule changes reach the whole fleet in ~1s; locally defined rules override fleet-wide rules.
- Licensed on ingested volume, quoted in annual tiers. Node count is not a billing lever. Object storage is billed directly by the customer's cloud provider.

Independent verification (not an Auditty claim):

AppsFlyer's platform team published their own evaluation in AppsFlyer Engineering
(November 2025), "How We Cut Log Volume Without Blindfolding Production":
https://medium.com/appsflyerengineering/how-we-cut-log-volume-without-blindfolding-production-05d82be13ec9

They mapped roughly 1,800 log sources, found only a single-digit percentage of their
logs were used for debugging or incident response, then replayed a full peak hour of
production traffic through Auditty in a segregated account before deploying it. Their
reported results, with the scope of each: 66%: average suppression across their top log emitters, in evaluation; 50%: sustained reduction across their Kafka infrastructure, in production; 1,000+: servers running the agent, across ~50 Kafka clusters. They state that processing occurs entirely in their own accounts with
no data leaving their premises, that the agent fails open so logs flow normally if it
fails, and that identifiers such as UUIDs are not suppressed. On incident response:
"We didn’t see any regression in our ability to investigate incidents, and we can easily opt out any sensitive components."

## Pages

- [Home](https://auditty.ai/): What Auditty does and why keeping all of the data changes how aggressively you can reduce what you forward.
- [Platform](https://auditty.ai/platform): The five on-node stages a log line passes through: interception, classification, field extraction, an automatic decision you can override, and delivery to both your SIEM and your own indexed archive.
- [Security and architecture](https://auditty.ai/security): Where the data boundary sits, every privilege the DaemonSet needs and why, the behaviour in each failure mode, and release provenance.
- [Pricing](https://auditty.ai/pricing): Licensing on ingested volume, plus a calculator for the ingest cost you would stop paying and the object storage cost of retaining 100% of the raw data.
- [How Auditty compares](https://auditty.ai/compare): Auditty against Grepr, Cribl, Edge Delta and Datadog’s own cost controls, with every claim about another product quoted from their documentation and every page naming where they are the better choice.
- [Auditty vs Grepr](https://auditty.ai/compare/grepr): Both reduce log volume by pattern and keep the raw data. Grepr processes it in Grepr’s AWS account; Auditty processes it on your node and never puts anything in the network path. Sourced from both vendors’ own documentation.
- [Auditty vs Cribl](https://auditty.ai/compare/cribl): Cribl gives you the tools to express what to drop. Auditty decides per pattern with no rules written, and keeps every line in your own bucket. Sourced from Cribl’s own sizing, pricing and Lake documentation.
- [Auditty vs Edge Delta](https://auditty.ai/compare/edge-delta): Both put an agent on the node. Edge Delta is a full observability platform with its own backend; Auditty is one bounded agent that feeds the tools you already own. Sourced from Edge Delta’s own Helm and architecture documentation.
- [Auditty vs Datadog’s own log cost controls](https://auditty.ai/compare/datadog): Exclusion filters, Flex Logs and Archive Search are good and often enough. What they do not change is the per-GB ingestion charge, because excluded logs are still ingested. Sourced from Datadog’s own docs and price list.
- [Frequently asked questions](https://auditty.ai/faq): Direct answers on interception, suppression, retrieval, data handling, resource usage and licensing.
- [Book a demo](https://auditty.ai/contact): Request a walkthrough against a sample of your own logs.
- [Documentation](https://auditty.ai/docs): Installation, configuration, suppression and rule reference, the vault archive, metrics and access control.
- [Platform Overview (documentation)](https://auditty.ai/docs/overview): Auditty AI data engine overview and architecture
- [Installation (documentation)](https://auditty.ai/docs/installation): Deploy Auditty Edge on Kubernetes, Linux VMs, the CLI, or as a network (OTLP) proxy
- [Configuration (documentation)](https://auditty.ai/docs/configuration): Rules and annotations guide for controlling log interception
- [Log Intelligence (documentation)](https://auditty.ai/docs/log-intelligence): How Auditty distinguishes signal from noise: searchable ids in summaries, full originals in the Vault
- [Suppression (documentation)](https://auditty.ai/docs/suppression): How Auditty reduces repetitive log noise
- [Vault (Log Archive) (documentation)](https://auditty.ai/docs/vault): Archive suppressed log lines to cloud storage and recover them instantly
- [Metrics (documentation)](https://auditty.ai/docs/metrics): Prometheus metrics for monitoring and observability
- [User Management & Access (documentation)](https://auditty.ai/docs/access): SSO authentication, roles, and team onboarding
- [Support (documentation)](https://auditty.ai/docs/support): How to get help and support
- [Privacy policy](https://auditty.ai/privacy): How Auditty handles visitor, demo-request and platform administrator data.

## The basics

- [What is Auditty?](https://auditty.ai/faq#what-is-auditty): Auditty is an AI data engine for Kubernetes logs. It classifies every container log line on the node, before it leaves the cluster, forwards the small fraction of lines that carry information to your existing SIEM or log vendor, summarises repetitive lines instead of shipping them, and writes 100% of the raw stream, compressed and indexed, to your own cloud storage.
- [How is Auditty different from log sampling or drop filters?](https://auditty.ai/faq#different-from-sampling): Sampling and drop filters destroy data permanently, so they force you to decide in advance which logs will matter during an incident that has not happened yet. Auditty never destroys anything: a suppressed line is still written in full to your own object storage, and can be retrieved later by pattern, time range or field value.
- [Does Auditty delete or lose any of my logs?](https://auditty.ai/faq#does-it-delete-logs): No. Auditty writes every log line it processes to your own object storage, compressed and indexed, including the lines it suppresses from the forwarding path. Suppression only determines what you pay to ship to your log vendor; it never determines what exists.
- [What log formats does Auditty support?](https://auditty.ai/faq#log-formats): Auditty handles plain text, JSON and logfmt. Deeply nested JSON is understood, including awkward real-world shapes: keys that contain literal dots, flattened ECS-style fields, and arrays whose contents vary from line to line.
- [Does Auditty work outside Kubernetes?](https://auditty.ai/faq#outside-kubernetes): Yes. Auditty ships a systemd service for bare virtual machines in addition to the Kubernetes DaemonSet, and a command-line tool for batch-processing log files directly. Kubernetes is the primary production deployment; the others apply the same classification and archiving to ordinary log files.

## How it works

- [How does Auditty intercept container logs?](https://auditty.ai/faq#how-interception-works): On the node, at the file level, without anything being inserted into the path between your workload and its log file. Your container runtime is unaffected and needs no reconfiguration: it goes on writing exactly as before, unaware that Auditty is there.
- [Does Auditty add latency to my applications?](https://auditty.ai/faq#added-latency): No. Auditty never sits in the request path of your application, and it does not touch the write path your container uses to emit logs. Your workload writes its logs exactly as before, at exactly the same speed.
- [How does Auditty decide what to forward and what to suppress?](https://auditty.ai/faq#how-it-decides): In almost all cases, automatically and without configuration. A pattern has to prove itself genuinely repetitive before Auditty will summarise it, and volume alone is not proof: a message emitted once by each of two hundred pods is treated as telemetry, not as noise. Errors, warnings and fatal levels are never suppressed automatically at all.
- [When Auditty suppresses thousands of lines, what do I actually receive?](https://auditty.ai/faq#what-is-in-a-summary): You receive a summary event carrying the pattern, the time window, the count, and the specifics: the actual distinct identifiers that appeared in the suppressed lines, such as request IDs, trace IDs, tenant IDs and IP addresses, together with the distribution of any numeric field, so you can see the spread of latencies rather than only that there were some. You lose the repetition, not the detail.
- [Can I get suppressed logs back later, and how fast?](https://auditty.ai/faq#can-i-get-logs-back): Yes, in seconds, and without scanning the archive. Every suppression summary links to the raw lines behind it, and following that link returns the actual log lines. The archive is indexed so that a retrieval reads only the small part of it that can contain matches, however large the bucket has become.
- [How much CPU and memory does the Auditty agent use?](https://auditty.ai/faq#resource-usage): In steady state, 60 to 80 MB of memory per node. The agent also ships with an enforced ceiling of 768 MiB and 1.5 vCPU, which it cannot exceed however much log volume you put through it, so the typical figure is what you should expect and the ceiling is what protects you if you are the exception.

## Security and data handling

- [Does Auditty see my log data?](https://auditty.ai/faq#does-auditty-see-my-logs): No. What leaves your cluster is log templates, the shape of a line with all values masked to placeholders, plus counts, rates, timing and node, namespace and workload names. A template records that a line of a given shape occurred, not what was in it, and cannot reconstruct the original.
- [Does Auditty need access to my cloud storage credentials?](https://auditty.ai/faq#cloud-credentials): No. Auditty's control plane holds no credentials for your object storage and has no network path to it. The archive is written by your own agent, running inside your own account, using credentials you issue and can revoke without involving Auditty.
- [Does Auditty run as a privileged container?](https://auditty.ai/faq#why-privileged): No. It runs with two scoped Linux capabilities, DAC_READ_SEARCH and SYS_PTRACE, rather than in privileged mode. Reading other containers’ log files does require host-level access, and those two capabilities are the whole of what that takes.
- [Where is my log data stored, and for how long?](https://auditty.ai/faq#where-is-data-stored): Your log data is stored in your own Amazon S3, Google Cloud Storage or Azure Blob Storage bucket, under a prefix you choose, compressed and partitioned by time in an open format your own tools can read. Auditty never holds a copy.
- [What happens to my logs if Auditty crashes or is removed?](https://auditty.ai/faq#if-auditty-fails): Your logs keep flowing. Restoring your log pipeline is the very first thing Auditty does on the way out, ahead of any of its own cleanup, so the file your log shipper watches is working again within milliseconds, before the process has finished exiting. After an abrupt kill or a node reboot there is nothing to repair by hand either: the same restoration happens automatically, in milliseconds, and removing Auditty entirely leaves your logging exactly as it was before you installed it.

## Running it

- [How long does it take to deploy Auditty?](https://auditty.ai/faq#how-to-deploy): Auditty installs as a single Helm release and begins classifying logs immediately with its built-in pattern recognition, before you have written any rules. There is no schema to define, no parser to configure and no queue or collector tier to provision.
- [How do rule changes reach the fleet?](https://auditty.ai/faq#rule-propagation): A rule saved in the Auditty control plane reaches every node in roughly one second, without polling delay and without a steady stream of background requests when nothing is changing.
- [Can a central team override rules a cluster owner depends on?](https://auditty.ai/faq#local-vs-fleet-rules): No. A rule defined locally on a node shadows a fleet-wide rule of the same name, so the local definition is authoritative. This prevents a platform team from silently changing behaviour that a cluster owner relies on.
- [Does Auditty replace Datadog, Splunk or my existing SIEM?](https://auditty.ai/faq#replace-my-siem): No. Auditty sits upstream of your existing log vendor and reduces what reaches it. You keep your dashboards, alerts, queries and runbooks; they simply operate on a stream that no longer contains the repetitive lines nobody reads.
- [Does Auditty detect anomalies on its own?](https://auditty.ai/faq#anomaly-detection): Yes. Auditty flags the first occurrence of a previously unseen log pattern, sudden spikes in the rate of a known pattern, numeric values that fall far outside a pattern's established range, and previously unseen values on low-cardinality categorical fields.

## Cost and licensing

- [How is Auditty priced?](https://auditty.ai/faq#pricing-model): Auditty is licensed on ingested volume, meaning the bytes the agent reads on the node, and quoted in annual tiers so the rate falls as volume rises. We meter what we read rather than what we forward, so tightening your rules cuts your log vendor bill without changing what you pay us.
- [How much can Auditty actually save me?](https://auditty.ai/faq#how-much-savings): Savings depend on how repetitive your logs are, and most production log volume is highly repetitive. Deployments typically settle at forwarding between 3% and 10% of ingested volume, with the remainder summarised and archived.
- [Does Auditty stop working if it cannot reach your servers?](https://auditty.ai/faq#licence-offline): No. Auditty entitlements are cryptographically signed tokens verified locally on the node, so there is no phone-home licence check that can disable your log pipeline when Auditty's service has an outage.

## Optional

- [Full site content as markdown](https://auditty.ai/llms-full.txt): every page summary and every FAQ answer in full, in one file.
- [Documentation](https://auditty.ai/docs): installation, configuration reference, rule syntax, suppression, the vault archive, metrics and access control.
- [Contact](https://auditty.ai/contact): request a demo. Email hi@auditty.ai.