ACL LOG

Lists recent security events generated due to ACL rules.

Browse all commands · Upstream source documentation

Reference field	Value
Canonical name	ACL LOG
Catalog group	Server commands
Upstream since	6.0.0 — upstream Redis/module version, not an ffkv release
Pinned catalog	Redis 8.10.0

Syntax

ACL LOG [count | RESET]

ffkv behavior and limits

Server introspection describes ffkv, not a Redis process. MEMORY reports owned-allocation estimates, not jemalloc accounting. Administrative changes can affect all clients or persistent data; consult the scenario and operations guide before using destructive forms.

Source: README.md:393–395, 601–642; tests/bdd/features/server.feature; tests/bdd/features/catalog.feature.

All requests share the 8 MiB framing/1,024-argument ingress limit; normal RESP replies have 64 MiB wire/logical budgets with bounded nesting/value counts. Management and Lua origins impose smaller budgets. These are not a process RSS cap. Catalog inclusion is not exhaustive option or wire-format parity. See limits and compatibility.

Upstream metadata

The following fields come from the pinned Redis metadata, not measured ffkv performance or an assertion that ffkv enforces every upstream flag. Running COMMAND INFO/COMMAND DOCS describe the current engine.

Upstream Redis complexity: O(N) with N being the number of entries shown.

Upstream arity: -2 (includes the command name; a negative number is a minimum).

Command flags: ADMIN, NOSCRIPT, LOADING, STALE, SENTINEL.

Argument structure

Argument	Type	Constraints / metadata
operation	oneof	optional
↳ count	integer	Required
↳ reset	pure-token	token: RESET

Additional pinned upstream metadata

{
  "group": "server",
  "since": "6.0.0",
  "history": [
    [
      "7.2.0",
      "Added entry ID, timestamp created, and timestamp last updated."
    ]
  ]
}

Metadata source · Local snapshot: src/command_metadata.json, key acl|log.

BDD coverage and source examples

These are source observations, not a test run performed by this documentation build. A tag identifies scenario intent; an extracted vector identifies a command invocation, which may intentionally produce an error. Scenarios may require setup, multiple connections, persistence, cluster nodes or native-module fixtures.

• ACL LOG records only the rejected command, key or channel (Scenario Outline) — tests/bdd/features/client_control_repair.feature:344; command tag and invocation observed.
• Nested Lua key denial retains the calling identity and Lua context — tests/bdd/features/client_control_repair.feature:380; command tag and invocation observed.
• EXEC reauthorization logs denials in transaction context after an ACL update — tests/bdd/features/client_control_repair.feature:406; command tag and invocation observed.
• Native module callbacks cannot hide command denials from ACL LOG — tests/bdd/features/client_control_repair.feature:448; command tag and invocation observed.
• Dynamic index namespace denials are logged without logging visibility filtering — tests/bdd/features/client_control_repair.feature:474; command tag and invocation observed.
• Dynamic document deletion denials identify only the rejected document — tests/bdd/features/client_control_repair.feature:533; command tag and invocation observed.
• A denied actual SORT lookup logs the resource and leaves STORE unchanged — tests/bdd/features/client_control_repair.feature:621; command tag and invocation observed.
• ACL log records failed authentication without disclosing supplied passwords — tests/bdd/features/server.feature:1309; command tag and invocation observed.

Extracted command vectors

The following JSON arrays are the test harness’s argument vectors, not shell commands. Numeric arguments are converted by the harness; objects of the form {"base64":"…"} represent decoded binary bytes, not a literal JSON command argument. Preserve scenario setup and connection ordering. See the CLI guide for shell quoting and binary stdin. No reply is invented or inferred.

ACL LOG records only the rejected command, key or channel — tests/bdd/features/client_control_repair.feature:360 (client “audit” executes:)

Expanded from an actual Examples row: command=["SET","allowed","payload-secret"], reason=command, object=set.

[
  "ACL",
  "LOG"
]

Next source assertion: the reply has 1 items

ACL log records failed authentication without disclosing supplied passwords — tests/bdd/features/server.feature:1321 (client “security-admin” executes:)

[
  "ACL",
  "LOG",
  "1"
]

Next source assertion: the reply contains:

[{"count":1,"reason":"auth","context":"toplevel","object":"AUTH","username":"audit-user"}]

Dynamic index namespace denials are logged without logging visibility filtering — tests/bdd/features/client_control_repair.feature:514 (I execute:)

[
  "ACL",
  "LOG",
  "RESET"
]