Audit · Guides
Search and export events
Find out what happened: by person, action, account or time. Open an event to see everything it holds and that it is still as it was recorded, and take a CSV of any search.
Who can read the log
A person's level in Audit is set at id, in the workspace's roles, as it is for every product:
- Triage is Audit's reader: Events and People, the searches, the exports and the access reports.
- Viewer sees the dashboard's counts and Integrity, which show hashes and numbers, never anyone's actions.
- Admin reads as Triage does, and also sees Who read it and the project's Settings.
Search
Events lists everything kept, newest first, 50 to a page. Every field of the search is optional:
| Field | Finds |
|---|---|
| Person | One of your people by their id, in any part of an event: the person who did it, the person it was done to, the person it was about. |
| Action | An action whole, or the start of some with a *: customer.*. |
| Account | Every event in one account. |
| From, To | On your own clock, as your Preferences at id set it. To takes in the minute it names; a date alone takes in the whole day. |
| Who did it, Their id | Under More: the actor's kind (person, operator, system) and id. |
| To what, Its id | Under More: the target's kind and id. |
| About person | Under More: only the events where they are the subject. |
| Request | Under More: the events recorded in one of your requests, by the id your log lines carry. |
Ids are found whole: u_88 doesn't find u_88231. The same ids work in the search box of services.my-beast.com, which says how many of a project's events name a person, an account or a request, and links here.
Narrow the list
- Quick times above the list: the last hour, day or week, or any time.
- Chips show what narrows the list. Its × takes one off.
- A value in a row, such as an actor or an account, narrows the list to it.
An event's page
A row opens its event: what was done, who did it, to what, about whom, in which account, the reason given, the context, when it happened and when Audit kept it. Each id links to your console when the project's Links are set (Ids, never names).
- In the chain says whether the event still gives its hash and follows the event before it, with its number and both hashes. Before and After step along the chain.
- Request lists every event of the same request, and that request's log lines in Logs and errors in Errors.
- Beside it, the other products the project has say what they have of the same minute: the person's recording in Sessions, errors, incidents, changes to Secrets. Each shows only for people who open the project in that product.
Export a CSV
Export CSV above the list downloads every event of the search, not only the page you see, with every column, the chain's too:
seq, occurred_at, recorded_at, action, actor_type, actor_id, target_type, target_id, subject, account, reason, context, request_id, event_id, prev_hash, hash.
Times are UTC to the millisecond. A cell that a spreadsheet would read as a formula starts with a '. An export is the copy to keep outside Audit, for an auditor or after an incident.
Every read is recorded
Before an answer goes out, Audit writes it down in its own log: each search with what it asked and how many it found, each event opened, each export with its number of rows. So is a count that names any event, such as the search box's or the dashboard's list of who handled people's data most. The project's admins see them all on Who read it.