> For the complete documentation index, see [llms.txt](https://docs.akenza.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.akenza.io/device-management/managing-an-organization/audit-logs.md). # Audit Logs A record of what changed in your organization, when it changed, and who changed it.

**Audit logs** record the changes made to the objects in your organization. Every entry names the object, the kind of change, the moment it happened, and the account behind it, which makes them the place to go when a dashboard looks different from yesterday, a rule stopped firing, or something is missing and nobody remembers removing it. They are found under **Settings > Audit logs** and cover the whole organization, including all of its workspaces. {% hint style="info" %} Audit logs are visible to the **organization owner** and **organization admins**, the same roles that can reach [API keys](/device-management/managing-an-organization/api-keys.md) and change organization settings. {% endhint %} ## What an entry records

Column	What it shows
Action	View log, which opens the entry in full.
Timestamp	When the change was recorded. The list starts with the most recent.
Event	The kind of change: Create, Update, or Delete.
Resource name	The name the object had at the time. It links to the object where it still exists, so a delete entry is plain text.
Resource type	What kind of object it was, for example a dashboard, a rule, or a device.
Resource ID	The object's identifier, which stays the same even when it is renamed. This is the value to use when following up through the API.
Agent	The account that made the change.
Workspace	The workspace the object belongs to. Objects held at organization level, such as dashboards, show no workspace.

Because the name is stored as it was at the time, renaming an object does not rewrite its history. An entry from before a rename still shows the old name, while the resource ID ties both to the same object. ## Reading a change *View log* opens the entry and shows what actually changed, comparing the object before and after as a diff. For an **Update** this is the quickest way to see which field moved, rather than inferring it from the object's current state. ## Finding a specific change The list holds every change in the organization and grows quickly, so it is paginated, with the total count shown above it. Three things narrow it down: * **Search** across the entries, for example by the name of the object you are investigating. * **Filter**, using the filter button next to the search field. * **Sort** by event, resource name, resource type, resource ID, or agent, using the arrows in the column headers. Sorting by **agent** answers "what did this person change", and sorting by **resource ID** groups every entry for one object together, including the entries from before it was renamed. ## What to use them for * **Explaining a change in behaviour.** A rule that stopped sending notifications, or a dashboard that lost a component, usually has an **Update** entry from the moment it changed. * **Recovering context after a deletion.** A **Delete** entry records what was removed, by whom, and when. * **Reviewing activity.** Filtering by agent shows what an account has been doing, which is worth checking when someone leaves the organization or a credential is suspected of being exposed. {% hint style="info" %} Audit logs record changes to configuration, not the measurements your devices send. For how the fleet itself is behaving, see the [Data Processing Logs](/device-management/data-processing-logs.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.akenza.io/device-management/managing-an-organization/audit-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.