Audit log: who changed what and when
The Audit log keeps a record of every change made in the system: who did it, when, from which IP address, to which object, and the value before and after. It is the page to open when someone asks "who changed this, and what was it before?"
It sits next to the older Action log; the two pages are separate and do not share their data. Passwords and other secrets are never stored in the Audit log — they only show up as changed.
Where to find it
Two ways lead to the page: the Audit log tile on the Statistics hub, and the Audit log entry in the sidebar under System. Either way the page is called Audit log, with a Statistics link above the heading to go back.
Who can see it
The Audit log is for the administrator only. A system user sees it only when the right audit_log.view is ticked for that account (area audit_log, verb view). Without the tick the page, the sidebar entry and the export are closed.
A system user that inherits the view of an administrator does not get the Audit log automatically. The right has to be ticked on purpose, account by account.
The list
Newest entry first. Each row is one change; the table is split into pages of 50 rows. A line above the filters says how many entries there are, and a second line tells you how long entries are kept (see Automatic clean-up).
| Column | Meaning |
|---|---|
Time | When the change happened, in the system's own time, 24-hour clock. Select the heading to reverse the sort order. |
Acted by | The person. For a system user the real staff member is named, and a small System access tag marks it; the name stays in the log even after the system user has been deleted. Other tags: Device (a device's own portal login) and Background job (the system itself). If someone signed in as another account with Login as, the line "as <name>" shows whose account was used. |
IP address | The address the change came from. |
Area | Which part of the system: Providers, Devices, DIDs, Users, Tariffs, Servers, Settings, Billing and so on. |
Operation | Created, Changed, Deleted or Other. An Other entry also names the event, for example login for a sign-in or rates_imported for a rate import. |
Target | What was changed: its name, its number (#2256) and, in small letters underneath, its kind (provider, server, terminator …). |
The details of one entry
Select the arrow at the start of a row to open it. The opened row shows the entry number, the owner and, where there is one, the affected user — and below it a table of the fields that changed, each with its value Before and After.
| Shown as | Meaning |
|---|---|
A value in Before / After | The field's value. A dash in Before means the field did not exist or was empty (typical for a newly created object). |
| changed | A secret was set or changed: passwords, SIP secrets, keys, tokens and PINs. The value itself is never stored, so nobody can read it from the log. The same label is used for long free texts (mail templates, server notes, phone-book contacts) — the log shows that they changed, not what they said. |
Bulk change: N objects | One action changed many objects at once. First IDs lists the first few of them. |
No values were recorded for this entry. | The event is logged, but there is no field-by-field comparison for it — for example a sign-in. |
Filters
Fill in one or more fields and select Filter; Reset clears them. All fields work together.
| Field | Meaning |
|---|---|
From / Until | The period, each with a date and — if you want — an hour and a minute. |
Acted by | The person's name (part of the name is enough). |
Actor type | User, System access, Device or Background job. |
Area | One area from the list, for example Providers or Settings. |
Operation | Created, Changed, Deleted or Other. |
Target type / Target ID | The kind of object (provider, device …) and its number. |
IP address | Only entries that came from this address; the first part of an address is enough. |
Free text | Searches the person, the target's name, the target's kind and the recorded values. |
Export as CSV or Excel
CSV export and XLSX export at the top right of the page download the entries as a table file. The export uses exactly the filter that is set at that moment — set the period and the area first, then export. An export holds at most 10,000 rows. If more entries match, a warning above the filters tells you how many there are; narrow the period or another filter to get all of them.
To hand one customer's history to someone, filter by Free text or by Target type and Target ID, check the row count, then export.
Automatic clean-up
A nightly job removes Audit log entries that are older than 24 months. It touches nothing else: calls are never deleted, and neither is the old Action log. The line below the page heading says which way it is set — "Entries are removed after 24 months." or "Automatic clean-up is switched off: entries are not removed."
The switch is under Settings, in the group Security and audit log: Clean up the audit log automatically (on by default). Switched off, nothing is removed and the log keeps growing.
The older Action log
The Statistics hub still has its older tile Action log ("Audit log of all system actions"). That page is unchanged and stays next to the new one. The new Audit log is the one that shows the value before and after, the IP address and the real person.
Check
Change something harmless — rename a terminator, for example — then open the Audit log: the top row should show your name, your IP address, the area Terminators, the operation Changed and, in the opened row, the old and the new name.