Streaming is worth it when you need a continuous, complete copy of audit events and you are on an enterprise account. For many small teams, a scheduled monthly export is enough. Streaming becomes attractive when the 180 day window, export size limits or incident response needs start to bite.
What streaming does
GitHub documents audit log streaming for enterprise accounts, available to enterprise owners. It sends audit events and Git events from all organizations in the enterprise to an external data management system. Events are sent as compressed JSON files, and the filename format is year, month, day, hour, minute, uuid with a json.log.gz ending.
The documentation lists three benefits: data exploration in your own tools, data continuity, and data retention for as long as you choose.
The buffer you should know about
If you pause a stream, GitHub keeps a buffer for seven days, so nothing is lost for the first week. If a stream stays paused longer than seven days, it resumes from a point one week before the current time. If paused for three weeks or more, no data is retained and the stream starts fresh. A stream also exports only from the time it is enabled onward, so it does not backfill history.
Practical rule: if you ever pause a stream, put a calendar reminder on day five.
Streaming or monthly export
| Question | Monthly export | Streaming |
|---|---|---|
| Needs enterprise account | No, organization owners can export | Yes, enterprise owners |
| Coverage gaps possible | Yes, between runs and if you forget | Reduced, continuous |
| Includes Git events | Check the docs for your plan | Yes, per the documentation |
| Setup effort | A calendar entry | A destination and configuration |
| Good for | Annual audit evidence | Investigations and long retention |
A decision guide
Choose a monthly export if all of these hold:
- Your audit window is a year or less and you export at least every few months.
- You have no need to keep Git event data.
- You have two people able to run the export.
Choose streaming if any of these hold:
- You must retain events for longer than your tools allow.
- You want to search events during an incident without a manual export.
- Your volume makes exports hit the size or time ceiling.
Whichever you pick, test a restore: open a stored file, find a known event, and write down how long it took. An archive nobody has read is a guess.
Keep the data protected
Audit data contains usernames and activity. Store it with restricted access and, ideally, write-once settings on the bucket so the copy is credible as evidence. Log who reads it.
See also how long GitHub keeps audit log events.
Try it yourself
Click through it at your own pace, or open it full screen. Compare a continuous check with a point in time one.
Where Safeguard fits
Safeguard offers compliance and evidence automation and continuous dependency scanning, which gives your scanner side a dated record without a separate pipeline. Start with the free scan.
Quick check
Does streaming backfill past events?
No. The documentation says the stream exports activity from the time it is enabled onwards.
What happens if a stream is paused for a month?
Paused for three weeks or more, the stream retains no data and starts anew from the current timestamp.
Sources
- GitHub Docs: streaming the audit log for your enterprise
- GitHub Docs: reviewing the audit log for your organization
Last reviewed: 19 October 2026.
