This message was deleted.

Not really an answer per-se but there is an option to enable audit logging when starting starting rancher both at the rancher and cluster level. You looked at the docs for these options? https://ranchermanager.docs.rancher.com/v2.7/how-to-guides/advanced-user-guides/enable-api-audit-log https://ranchermanager.docs.rancher.com/v2.7/how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters