GitHub's organization audit log lists events from the last 180 days, and only organization owners can open it. You can export results as JSON or CSV, but exports have hard limits. For an audit window longer than six months, export on a schedule and store the files yourself.
What the audit log records
The audit log shows events that affect your organization: changes to settings and access, membership changes, app permissions and similar actions. By default the view shows the past three months, and you widen it with the created qualifier. The documentation states the log contains data for the last 180 days.
That matters because an access review in month nine of an audit period may need to show who was added in month two.
Export limits to plan around
GitHub's documentation lists a hard limit on exports: a 100 MB compressed file, or 10 minutes of processing time, or both. The advice is to narrow the dataset before exporting. Filters you can apply include action, actor, user, org, repo and created.
| Setting | What the documentation says |
|---|---|
| Time covered | Last 180 days |
| Default view | Past three months |
| Formats | JSON or CSV |
| Export ceiling | 100 MB compressed or 10 minutes |
A monthly routine that fits a small team
- On the first working day, open the organization audit log as an owner.
- Set the created filter to the previous calendar month, for example a range from the first to the last day.
- Export as JSON. JSON keeps field names for later queries.
- Name the file with the organization and month, then store it in your evidence folder.
- Note the date, who ran it and the filter used, in a short log.
- If the export fails on size, split the month into halves.
Run this even when nothing seems to have happened. An empty month is also a fact, and a gap in the sequence of files invites questions.
What not to rely on
An export is a copy of events, not a statement that controls worked. It shows that a member was removed. It does not show that removal happened within your policy timeframe unless you also keep the ticket or the offboarding date. Pair the log with the source record that defines what should have happened.
Also keep in mind who can see it. Only owners can open the log, so check that at least two people can run the export. A single owner on leave is a gap.
Where this stops being enough
If you need continuous copies, GitHub documents audit log streaming for enterprise accounts. See our post on whether streaming is worth it for a small team.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how one stored record can support more than one control.
Where Safeguard fits
Safeguard offers compliance and evidence automation and asset discovery, so records you collect are indexed against controls rather than left as loose files. You can also run a free scan.
Quick check
Can any member see the organization audit log?
The documentation says only owners can access an organization's audit log.
Is a JSON or CSV export better for audits?
Both are offered. JSON preserves structure for later filtering, while CSV opens easily in a spreadsheet. Pick one and stay consistent.
Sources
Last reviewed: 19 October 2026.
