Data and records Audit log
Audit log
The Audit log records who changed what in your workspace, who signed in, who read held content, and what happened to machines and connections. Sign-ins, changes to settings and policies, and machine lifecycle are recorded here as they happen.
Who can do it
Reading needs View the audit log (audit_log:read), which the Owner, Admin and Compliance reader roles hold. Without it the page says "Reading the audit log needs the audit_log:read permission." No role can edit or delete an entry.
Find an entry
- Open Settings › Records › Audit log.
- Narrow the list with Category, Actor, the date range, or Action contains…. The range starts at Last 7 days; the others are Last 24 hours, Last 30 days, Last 90 days and All time.
- Choose a row to open it beside the list. Close returns to the table.
The table shows When, Category, Action, Actor and Target. An entry with no person behind it shows System as the actor.
The page shows these categories: Audit (changes to policies, engines and settings), Access (sign-ins, members, keys and content reveals), Fleet (machine enrolment, configuration and lifecycle) and Connections (connection syncs and changes). Interactions, file events, alerts and issues keep their own pages.
Read an entry
An opened entry shows its title, then a line of the form "Category · kept N days · how long ago", where N is that entry's own retention window. Below are these facts.
| Fact | What it shows |
|---|---|
| When | The time, in UTC. |
| Actor | The person's name or address, and their role. A platform admin is marked as one. |
| From | The IP address and browser, or Not recorded. |
| Target | What the action was about, with a copy button, or None. |
| Correlation id | The id that ties the entry to the API's own log line, or Not recorded. |
The Detail section holds the entry's own record as JSON.
Two kinds of entry matter for trust. A content reveal is written before the content is shown. An entry made when a platform admin enters your workspace is written whether or not that admin is also a member; the row says which. Both are kept for seven years by default. See Retention and Access inside Oxelone.
Export
Choose Export and then CSV or NDJSON. The export uses the filter you have applied and downloads the whole of it, up to 100,000 entries. Exporting is itself recorded in the audit log.
To send entries to a SIEM as they happen instead, use Log streaming.
Every control
| Control | What it does | Default |
|---|---|---|
| Category | Narrows to one or more categories. | All |
| Actor | Narrows to one person. | Everyone |
| When | The date range. | Last 7 days |
| Action contains… | Searches the action. It waits a moment after you stop typing. | Empty |
| Export | CSV or NDJSON. | None |
When it goes wrong
- Reading the audit log needs the audit_log:read permission. Ask an Owner or Admin to change your role.
- Reading the audit log requires audit_log:read in this workspace. The same refusal, from the API.
- The audit log could not be read. Reload the page.
- Could not load more events. / Could not load this event. Try again.
- Nothing recorded in this range is not an error. Widen the range.
With the API
Not available with an API key.