Search and filter the audit log
Find the Activity you want by search text, time range, category, outcome, user or action, and send the view to others as a link.
This page helps you find the Activity you want in the audit log. Every filter takes effect as soon as you change it, and the number above the table says how many Activities were found.
Search by words
Type in the Search name, id, user or IP box. It searches Item names, user names and IP addresses.
Choose a time range
- Click the time range menu, which is set to Last 7 days.
- Choose Last 24 hours, Last 30 days or Custom….
- If you choose Custom…, pick a date and time in the From and To fields. If you leave a field empty, that side has no limit.
Filter by category and outcome
Click the All categories menu and choose a category.
| Category | What is in it |
|---|---|
| Sign-in | Signing in and out, two-step verification, password resets and refused requests |
| Items | Creating, opening, sharing, moving, deleting and importing Items |
| Records | Adding, editing, deleting and restoring Records |
| Administration | Users, roles, groups, settings and apps |
| Keys & secrets | API keys and OAuth clients |
| Audit log reads | Searching, exporting and verifying the audit log |
The buttons All, Succeeded and Failed filter by outcome. A failed Activity is a red row.
Filter by user, action or type
- Click More filters.
- Choose in the fields User, Action or Item type. You can choose several values in one field.
An Activity is shown only if it matches every filter you set.
To find failed sign-ins, do not filter by user name, because an Activity does not keep the name that the person typed. Choose the category Sign-in with Failed instead.
Clear the filters
The filters in use show as chips under the filter bar. Click x on a chip to remove that filter, or click Clear all to start over.
Sort and change page
Click a column heading to sort. Use the buttons under the table to change page, or change Rows per page: to 25, 50 or 100. To load the data again, click Refresh.
Send the view to others
The address in the browser bar keeps all the filters. Copy it and send it to others. The person who opens it needs the viewAuditLog permission.
If you chose Last 7 days, the link counts 7 days back from the day it is opened. If you want a fixed time range, use Custom….
If nothing is found
If it says "No activity matches these filters", click Clear filters. If the table is empty and says you need the viewAuditLog permission, see Who can open it.