Skip to main content
The Audit Log chronologically records all major activities in the system. Transparently track who, when, what, and how — meeting security audit and compliance requirements. Access via Admin > Monitoring > Audit Logs.
Audit Log main screen
Audit Log is a licensed feature. Requires a license with audit_log feature enabled.

​
Recorded Activities

​
Action Types

ActionDescription
CREATEResource creation
UPDATEResource modification
DELETEResource deletion
ACCESS_CONTROL_CHANGEResource access permission change
PERMISSION_CHANGEGroup feature permission change
MEMBER_ADDGroup/organization member addition
MEMBER_REMOVEGroup/organization member removal
ROLE_CHANGEUser role change
SETTINGS_CHANGESystem setting change
LOGINSign in
LOGOUTSign out
LOGIN_FAILEDSign-in failure
API_KEY_CREATEDAPI key issuance
API_KEY_DELETEDAPI key revocation
GUEST_SESSIONEmbed widget guest session start

​
Resource Types

ResourceAuto-trackedDescription
model✅AI model
knowledge✅Knowledge Base
dbsphere✅Database connection
glossary✅Glossary
prompt✅Prompt
tool✅Tool
user✅User
organization✅Organization
organizational_unit✅Organizational unit
group✅Group
agent⚠️Agent — only explicit logging calls are recorded (no auto-tracking)
chat⚠️Chat — only explicit logging calls are recorded (no auto-tracking)
admin_settings⚠️Admin settings change — explicit logging with SETTINGS_CHANGE action
auth⚠️Auth events — LOGIN/LOGOUT/LOGIN_FAILED auto, others explicit
memory⚠️Memory — only explicit logging calls are recorded
embed_widget⚠️Embed widget guest session — auto with GUEST_SESSION action
✅ marked resources are auto-recorded in the audit log on DB changes. ⚠️ marked resources are recorded only at points where the backend explicitly calls logging — some events are auto (LOGIN/LOGOUT/LOGIN_FAILED for auth, GUEST_SESSION for guest, SETTINGS_CHANGE for settings), but general CRUD on agent/chat/memory isn’t auto-tracked.READ is not logged separately (for performance).

​
Log Entry Structure

Each audit log entry includes:
FieldDescription
TimestampEvent occurrence time
UserActivity actor (name, email)
ActionPerformed action (CREATE, UPDATE, etc.)
Resource typeTarget resource type
Resource IDTarget resource identifier
Resource nameTarget resource name
Before statePre-change values (JSON)
After statePost-change values (JSON)
Changed fieldsList of changed fields
Permission change detailsAccess permission change details (when applicable)

​
Viewing Logs

​
Filter Options

FilterDescription
Time rangeStart/end date range (Unix timestamp)
Resource typemodel, knowledge, user, etc.
ActionCREATE, UPDATE, DELETE, LOGIN, etc.
UserSpecific user ID
OrganizationSpecific organization ID
Resource IDTrack changes to a specific resource

​
Log Detail View

Click a log entry to see details in a modal.
Audit Log detail modal
Information shown:
  • Full request metadata
  • Before/after state comparison (JSON diff)
  • Highlighted changed fields
  • Detailed access control changes for permission changes

​
Statistics

Audit log statistics help understand overall activity patterns.
Audit log statistics
StatisticDescription
Action distributionCount by action (CREATE, UPDATE, DELETE, etc.)
Resource type distributionCount by resource (model, user, chat, etc.)
Total countTotal audit log entries in the period

​
Use Cases

  1. In the Audit Log tab, set the time range around the incident
  2. Filter by relevant user or resource type
  3. Review activity history chronologically
  4. Verify changes via detail view
  5. Preserve detailed logs as evidence
  1. Periodically (monthly/quarterly) review audit log statistics
  2. Review permission change logs to detect unauthorized access
  3. Track setting change history to verify policy compliance
  4. Compose audit reports based on audit logs
  • Mass resource deletion outside business hours
  • Repeated permission changes in short periods
  • Abnormal sign-in failure patterns
  • Admin permission escalation

​
Best Practices

The system auto-records audit logs. There’s no feature to delete or modify audit logs themselves — this preserves the integrity of the records.
  • Periodic review: Review audit logs at least monthly to detect anomaly patterns
  • Long-term retention: Per compliance requirements, retain for at least 1 year
  • Backup: Regularly back up audit log data to external storage
  • Notification integration: Configure alerts for important events (permission changes, mass deletions)