Audit Logs
Track all actions performed in your Zettabit system for security and compliance.
What are Audit Logs?
Audit logs record every significant action:
- Who performed the action
- What action was taken
- When it occurred
- What changed (before/after values)
Why Audit Logs Matter
Security
- Detect unauthorized access
- Investigate security incidents
- Monitor suspicious activity
Compliance
- Meet regulatory requirements
- Demonstrate accountability
- Provide evidence for audits
Operations
- Track changes over time
- Debug issues
- Understand system usage
Accessing Audit Logs
- Go to Settings > Audit Logs
- Or click Audit Logs in sidebar (if available)
Required permission: audit:read
Log Entry Information
Each log entry contains:
| Field | Description |
|---|---|
| Timestamp | When the action occurred |
| User | Who performed the action |
| Action | What was done |
| Resource | What was affected |
| Details | Additional information |
| IP Address | Where the action came from |
Logged Actions
Authentication Events
| Action | Description |
|---|---|
| user.login | User logged in |
| user.logout | User logged out |
| user.login.failed | Failed login attempt |
| user.2fa.enabled | Two-factor enabled |
| user.2fa.disabled | Two-factor disabled |
| user.password.changed | Password changed |
Client Actions
| Action | Description |
|---|---|
| client.create | New client added |
| client.update | Client information modified |
| client.delete | Client removed |
Subscription Actions
| Action | Description |
|---|---|
| subscription.create | Subscription created |
| subscription.update | Subscription modified |
| subscription.delete | Subscription cancelled |
| subscription.renew | Subscription renewed |
Package Actions
| Action | Description |
|---|---|
| package.create | Package created |
| package.update | Package modified |
| package.delete | Package removed |
Server Actions
| Action | Description |
|---|---|
| server.create | Server added |
| server.update | Server settings changed |
| server.delete | Server removed |
| server.sync | Manual sync triggered |
User Management
| Action | Description |
|---|---|
| user.create | User created |
| user.update | User modified |
| user.delete | User removed |
| role.create | Role created |
| role.update | Role permissions changed |
| role.delete | Role removed |
Settings Changes
| Action | Description |
|---|---|
| settings.update | System settings modified |
Filtering Logs
By Date Range
Select start and end dates to view logs from a specific period.
By User
Filter to see actions by a specific user:
- Select user from dropdown
- Or search by name
By Action Type
Filter by category:
- Authentication
- Clients
- Subscriptions
- Packages
- Network
- Users
- Settings
By Resource
Find logs related to a specific record:
- Client ID
- Subscription ID
- Server name
Searching Logs
Use the search box to find logs containing specific text:
- User names
- Client names
- IP addresses
- Action types
Viewing Log Details
Click on a log entry to see full details:
Example: Client Update
Action: client.update
User: admin@yourcompany.com
Time: 2024-01-15 10:30:45
IP: 192.168.1.100
Changes:
- name: "John Doe" → "John M. Doe"
- phone: "01712345678" → "01712345679"Exporting Logs
Export logs for external analysis or compliance:
- Set your filters
- Click Export
- Choose format (CSV, JSON)
- Download file
Exports respect your current filters.
Log Retention
Logs are retained based on your settings:
| Setting | Retention |
|---|---|
| Standard | 90 days |
| Extended | 1 year |
| Compliance | 7 years |
Configure in Settings > Advanced > Data Retention.
Best Practices
Regular Review
- Check logs weekly for unusual activity
- Set up alerts for critical actions
- Review failed login attempts
Incident Investigation
When investigating:
- Identify the timeframe
- Filter by affected resource
- Review all related actions
- Check who was involved
- Document findings
Compliance Audits
For audits:
- Export logs for the audit period
- Include authentication events
- Show access to sensitive data
- Demonstrate access controls
Troubleshooting
Missing logs
- Logs for actions before implementation won’t exist
- Check date range filter
- Verify your permissions
Log shows wrong user
- User might have been impersonated by admin
- Check for API key usage
- Review session information
Too many logs
- Use filters to narrow down
- Export and analyze externally
- Consider increasing retention granularity
Required Permissions
| Action | Permission Required |
|---|---|
| View logs | audit:read |
| Export logs | audit:read |
Typically available to Admin and Manager roles.
Last updated on