Skip to content

Audit log

Every write operation (create, update, delete) on relevant objects, as well as logins and security-relevant actions, ends up in the audit log — with before/after values, actor and timestamp.

You find it under Admin → Logs & Support → Audit Log. The user portal has a view at /audit that always shows only your own actions — even for super admins — and points to the full log in the admin portal.

What's in it

Field Meaning
Timestamp when
Actor email or username of the account
Action e.g. host_create, dashboard_update, dashboard_soft_delete, login, login_failed, step_up
Target type / target ID the affected object, e.g. host, dashboard
Detail additional info (e.g. names of changed fields)
Before / after values before and after the change
Tenant tenant reference (empty for instance-wide actions)

There is no dedicated IP address field — for logins (including failed attempts) the source IP is in the details. Every entry with content can be expanded and shows the details in full, plus the before/after comparison.

Among other things the log also records changes to the SMTP settings (password only as "changed: yes/no"), licence changes (only the first six characters of the key), generated offline bundles, applied offline updates, wrong authenticator-app codes including the resulting lockout, and switching security-relevant settings.

Redacted fields

Credentials and secrets never appear in plain text in the audit log but as [REDACTED] — at every nesting level and also in entries written before this rule. This includes password hashes, 2FA secrets, token and key hashes, SNMP communities and SNMPv3 passwords, SSH passwords and keys, API tokens and passwords, dashboard share tokens and passwords, password/address fields of notification channels, secrets from credential sets and TLS/ACME keys. Search does not find values that are masked in the display.

Diff view

Expandable rows with diff highlighting between before and after, coloured red/green. On a phone long action names are shortened (full name on tap).

Filters

Filter Example
Search substring across actor, action and detail content
Action e.g. only dashboard_soft_delete
Target type only host
Time range from/to
Minor actions hidden by default (preference updates, saved filters, token refresh) — can be shown with a toggle

Filtering by target ID, category, host or actor is available via the API (GET /api/v1/audit/ with target_type, target_id, category, host_id, actor_email). Three predefined queries are also API-only: /api/v1/audit/quick/login-attempts (7 days), /quick/destructive (delete/purge/restore/import, 30 days) and /quick/mode-changes (90 days).

Visibility levels

Three permissions control how much an account sees:

Permission Effect
audit_log.view_own only your own actions
audit_log.view_tenant all actions in your own tenants (without instance-wide entries)
audit_log.view_global all actions, across tenants (super admin automatically)

view_global only applies if the account holds it in all tenants; if it only holds it in some tenants, it acts there like view_tenant. Instance-wide entries (super-admin logins, licence, admin access) are only visible to accounts with global view.

Audit on the host detail page

The History tab of a host detail page contains the sub-tab Changes in Vesana — the same audit view, limited to this host and its checks. It shows who created, changed or deleted the device and its checks in Vesana — not what happened on the device itself.

Retention

Audit entries are not deleted by default. A retention period can be set under Admin → System → Resources → Storage (the "Frugal" preset sets 730 days); deleted entries cannot be restored.

Security

  • The audit log is read-only in the interface — there is no edit function.
  • There is no CSV/JSON export and no manual purge — entries only disappear through a retention period you set yourself.

Compliance

When an auditor asks "who changed dashboard X on date Y?":

  • In the admin portal, filter by target type dashboard and time range, or via the API GET /api/v1/audit/?target_type=dashboard&target_id=<uuid>
  • Sorted by date, expand individually
  • The diff shows old and new values, the actor is visible