Skip to main content
Guardrail logs record all events detected and processed by guardrails configured on agents. Transparently track which user entered which sensitive info and how which guardrail processed it. Access via Admin > Monitoring > Guardrail Logs.
The same guardrail logs can also be viewed from Admin > Code Gateway > Guardrail Logs.
Guardrail Logs main screen

​
What are Guardrail Logs?

When users converse with the AI, guardrails validate inputs and outputs. When sensitive info is detected, the configured strategy (block, redact, mask, etc.) is applied and the result is logged.

​
Log Entry Structure

Each guardrail log entry includes:
FieldDescription
TimestampDetection event time
UserInput user (name, email)
Chat IDConversation session
Message IDMessage identifier
Guardrail nameApplied guardrail
ActionProcessing strategy (block, redact, mask, etc.)
Detection PatternDetection method (Rule-based / LLM-based)
Detection DetailSpecific detected content
Original contentOriginal input text
Processed ContentText after strategy applied

​
Action Types

ActionDescription
blockBlock entire message
redactReplace sensitive info with label (e.g., [REDACTED_EMAIL])
maskShow only some characters (e.g., j***@***.com)
hashConvert to hash value
logLog without blocking (shown as “Warning” in UI)

​
Detection Pattern

Detection methods are grouped into two categories.
GroupSourcesDescription
Rule-basedpii, custom_pattern, blocked_wordRegex/pattern-based detection
LLM-basedllm_judgeLLM-based content risk assessment
Individual source meanings:
SourceDescription
piiDetect PII patterns (email, credit card, IP address, etc.)
custom_patternDetect user-defined regex patterns
blocked_wordDetect prohibited words/phrases
llm_judgeLLM-based content risk assessment

​
Filter Options

FilterDescription
Time rangeStart/end date range
Actionblock, redact, mask, hash, log (multi-select)
Detection PatternRule-based / LLM-based group selection
User searchSearch by user ID, email, or name
Chat IDLogs for a specific chat session only
SourceRequest origin filter (e.g., code_gateway)

​
Log Detail View

Click a log entry to see details.
ItemDescription
GuardrailApplied guardrail name and ID
Detection PatternRule-based (PII, custom pattern, blocked word) or LLM-based (LLM Judge)
Detection DetailSpecific detected pattern or item
Original contentUser-entered original
Processed ContentResult after strategy applied

​
Tracing Integration

In guardrail log details, the Trace button lets you see the complete processing of that message.
1

Pick an entry in Guardrail Logs

Click the log entry for the guardrail event you’re investigating.
2

Click Trace

Click the Trace button in the detail modal.
3

View full processing

On the Evaluations > Tracing screen, view the full Run tree including the guardrail check for that message. Guardrail Runs are shown with red GD badges.

​
Use Cases

  1. Set a time range and view logs by Detection Pattern
  2. Review log action events to gauge false positive rate
  3. Adjust regex or exclude patterns with many false positives
  4. Add new patterns or blocked words for missed detections
  1. Look up a specific user’s guardrail events via user search
  2. Check repeated block patterns
  3. Review original content to determine intentional sensitive info leak attempts
  4. Cross-analyze with related audit logs for full context
  1. Filter Detection Pattern to LLM-based
  2. Review original content of blocked messages
  3. If excessive blocking, strengthen allow examples in the Judge prompt
  4. If missing blocks, add block examples

​
Guardrail Settings Integration

Improve guardrail settings based on patterns found in guardrail logs.
Log Analysis FindingRecommended Action
Specific PII type detected frequentlyStrengthen that type’s strategy from log → redact
Frequent false positivesNarrow custom pattern regex
LLM Judge over-blockingAdd allow examples to Judge prompt
New sensitive info pattern foundAdd regex via custom pattern
See Guardrails for guardrail configuration.