Audit log
The audit log is the organization's permanent record of activity: sign-ins, changes to records, settings, roles and users, exports, refused access. Each entry says who acted, when, from which IP address and browser, and, for changes, the values before and after. Entries cannot be changed or deleted, not even by owners.
Before you begin
- To open the audit log, you need View audit log (
core.audit.read). Owners and administrators have it by default. - To filter by person, you also need View users (
core.users.read).
Open the audit log
In the sidebar, under Administration, select Audit log. The newest entries come first, 50 per page. Use Older and Newer at the bottom to move between pages.
| Column | What it shows |
|---|---|
| When | Date and time, in your time zone. |
| Who | The person who acted, or System when no person did: an API key, an OAuth client, a workflow or a background job. |
| Action | The module (as a badge) and the action, for example Core user.invited or Organization Structure unit.updated. |
| Entity | The type and the start of the ID of the record concerned, for example role:0192ab3c. |
| IP | The IP address the request came from. |
Read an entry
Select an entry to open its details on the side:
- Module, Entity (with the full record ID), Who (name and email), IP and Browser (the browser's user agent).
- Changes: for changes, a table with each Field and its value Before and After.
- Details: other information recorded with the action, such as the email address of an invited person, the format and number of rows of an export, or the reason access was denied.
Find entries
Use the filters above the table. They combine: an entry must match all of them.
| Filter | How to use it |
|---|---|
| Search | Type part of an action or a record (type or ID), for example user. or export, then press Enter. |
| Module | Choose a module, or All modules. Only modules that have entries are listed. |
| Who | Choose a person, or Everyone. |
| From and To | Choose a date range. Both days are included. |
To see the full history of one record, select its value in the Entity column (History of this record). A badge with the record appears among the filters; select its × (Show every record) to remove it.
Select Clear filters to remove every filter. The filters are part of the page address, so you can bookmark a filtered view or send the link to another administrator.
If nothing matches, the log says No matching activity.
What is recorded
| Area | Actions |
|---|---|
| Sign-in and passwords | user.loggedIn, user.loginFailed (with the reason), user.signedUp, user.passwordResetRequested, user.passwordReset |
| People | user.invited, user.reinvited, user.invitationRevoked, user.joined (invitation accepted), user.added, user.updated (roles, status), user.removed |
| Roles | role.created, role.updated (permissions before and after), role.deleted |
| Settings | settings.changed and settings.reset (values before and after), settings.platformChanged for platform defaults |
| Modules | module.enabled, module.disabled, module.installed, module.upgraded, module.uninstalled |
| Integrations | apikey.created, apikey.revoked, oauth.client.created, oauth.client.revoked, webhook.created, webhook.updated, webhook.secretRotated, webhook.deleted |
| Data | import.completed (with the numbers added, updated and not imported), export.created, export.downloaded |
| Saved views | view.created, view.updated, view.deleted |
| Security | access.denied: someone tried an action their permissions do not allow |
| Module records | Each module records the creation, change and deletion of its records and its own actions, such as unit.created or member.assigned for Organization Structure. |
Personal preferences (theme, language, notification choices) are not recorded.
Messages and field names in the audit log stay in English, whatever language you use the app in.
Tips
- To review what a person did, choose them in Who and set From and To around the period you are interested in.
- To check failed sign-ins, search for
user.loginFailed. Several failures in a row for the same account can mean that someone is guessing a password. - To check who exported data, search for
export. - Entries of a record that was deleted stay in the log, so you can still see who deleted it and when.
Permissions
| Permission | What it allows | Granted by default to |
|---|---|---|
core.audit.read (View audit log) | Open the audit log and read every entry of the organization. | Owner, Administrator |