Audit Logs

A record of what changed in your organization, when it changed, and who changed it.

Audit logs record the changes made to the objects in your organization. Every entry names the object, the kind of change, the moment it happened, and the account behind it, which makes them the place to go when a dashboard looks different from yesterday, a rule stopped firing, or something is missing and nobody remembers removing it.

They are found under Settings > Audit logs and cover the whole organization, including all of its workspaces.

Audit logs are visible to the organization owner and organization admins, the same roles that can reach API keys and change organization settings.

What an entry records

Column	What it shows
Action	View log, which opens the entry in full.
Timestamp	When the change was recorded. The list starts with the most recent.
Event	The kind of change: Create, Update, or Delete.
Resource name	The name the object had at the time. It links to the object where it still exists, so a delete entry is plain text.
Resource type	What kind of object it was, for example a dashboard, a rule, or a device.
Resource ID	The object's identifier, which stays the same even when it is renamed. This is the value to use when following up through the API.
Agent	The account that made the change.
Workspace	The workspace the object belongs to. Objects held at organization level, such as dashboards, show no workspace.

Because the name is stored as it was at the time, renaming an object does not rewrite its history. An entry from before a rename still shows the old name, while the resource ID ties both to the same object.

Reading a change

View log opens the entry and shows what actually changed, comparing the object before and after as a diff. For an Update this is the quickest way to see which field moved, rather than inferring it from the object's current state.

Finding a specific change

The list holds every change in the organization and grows quickly, so it is paginated, with the total count shown above it. Three things narrow it down:

• Search across the entries, for example by the name of the object you are investigating.

• Filter, using the filter button next to the search field.

• Sort by event, resource name, resource type, resource ID, or agent, using the arrows in the column headers.

Sorting by agent answers "what did this person change", and sorting by resource ID groups every entry for one object together, including the entries from before it was renamed.

What to use them for

• Explaining a change in behaviour. A rule that stopped sending notifications, or a dashboard that lost a component, usually has an Update entry from the moment it changed.

• Recovering context after a deletion. A Delete entry records what was removed, by whom, and when.

• Reviewing activity. Filtering by agent shows what an account has been doing, which is worth checking when someone leaves the organization or a credential is suspected of being exposed.

Audit logs record changes to configuration, not the measurements your devices send. For how the fleet itself is behaving, see the Data Processing Logs.