Audit · Guides
See who read the log
An audit log holds what people did with other people's data, so reading it is recorded too. After an incident, who read the log is one of the first questions.
What is recorded
Audit writes each of these down before it answers:
- a search of the events, with what it asked, which page and how many it found,
- an event opened,
- an export, with how many rows,
- a person's access report opened or exported, with the person's id,
- a count that names any event: how many events were about a person on another product's page or in the search box, and the dashboard's list of who handled people's data most.
A count that finds nothing is not a read, and neither are the dashboard's totals and the Integrity page, which name no one's actions.
The Who read it page
Who read it is in the project's menu in Audit for its admins. It lists every read of the project's log, newest first: when, who by their email address, what they did, and the IP address it came from. Choose a person to see only their reads; Everyone shows them all again. The head of the page says how many reads there were in the last 7 days.
Each row says in words what was read: the search's fields, the event's number, the person whose report it was. An event or a report links to it, and opening it from there is a read of its own.
Its own chain
Every row Audit writes in its own log is also a link in a chain of its own, hashed, sealed every day and checked every night as a project's events are: see Check that the log is whole. So "who read it" can't be changed unseen either.
How long it is kept
The record of who read the log is kept for the same time for every project, then whole sealed days are removed, as a project's events are. It doesn't follow the project's own setting for its events. Data and privacy says how long each is kept.