Administration
Audit log
Who changed what, and when.
The Audit page keeps the trail of important changes in your tenant: who changed what, and when. You find it under Administration → Audit.
Who can see it
Opening the Audit page requires the Read audit trail permission. By default Tenant Admin, Service Desk Admin, and Auditor have it. Other users see an Access denied message. See Users, teams, and roles.
Audit entries can only be added. Nobody, including a Tenant Admin, can change or delete them from the application.
What is recorded
Each entry is written together with the change it records, so every successful change has an entry. What gets recorded:
| Group | Example actions |
|---|---|
| Sessions | Signed in, Signed out, Activated tenant |
| Tickets | Created ticket, Changed ticket status, Changed ticket priority, Assigned ticket, Added a comment, Added an attachment |
| Approvals | Decided an approval |
| Users, teams, and roles | Added user, Reset password, Changed user role, Changed team members, creating, updating, or deleting teams and roles |
| Organization | creating or updating sites, creating, updating, or deleting organization units, Updated company profile, Changed company logo |
| SLA and calendars | creating or updating SLA policies and working calendars, Imported holidays |
| Service catalog | creating or updating catalog categories and items, Published form version |
| Email channels | adding or updating mailboxes, Changed notification settings, Promoted email to ticket, Discarded email, Retried email delivery |
| Assets | Recorded asset, Changed asset status, Assigned asset, Released asset, Linked asset to ticket, Unlinked asset from ticket |
Passwords and other secret values, such as tokens and mailbox credentials, are never stored in audit entries. Failed sign-in attempts are not recorded here.
Reading the list
The table shows the newest entries first, with these columns:
- Time: the date and time of the event.
- Action: the name of the action. Hover over the action name to see its code, e.g.
ticket.status_changed. - Subject: the kind of object that changed and the first eight characters of its ID.
- Actor: the name of the user who made the change, or the label System for changes RANCAQ carried out itself.
Below the table are page numbers and a Rows per page choice.
Searching and filtering
- Search (Search action, subject, or actor…) matches the action code (e.g.
asset.assigned), the subject type code, the subject ID, and the actor's name or email. - Filter narrows the list by Action, Subject type, and Actor. The actor choices include System. You can pick several values at once.
- Sort orders the list by time, action, subject type, or actor.
- Group groups rows by action, subject type, or actor.
For example, to see every role change, choose Filter → Subject type → Role. To see everything one person did, choose Filter → Actor and pick their name.
Entry detail
Click a row to open Audit event detail. It contains:
- Time, Action with its code, Subject with its full ID, and Actor with their user ID.
- Trace ID: the identifier of the request that produced this entry. Include this value when you ask your server administrator about a problem.
- Before and After: the relevant data before and after the change, as JSON. The content differs per action and can be empty (
null), for example for Signed in.
Click Close to return to the list.