See who did what (the audit log)

Before you start

• The administrator role, or a role that lets you view logs. In the built-in set, administrators have that permission, and so do members of the “Security & Compliance” group. The “security_analyst” role has it too; no group carries it, so an administrator gives it to a person by hand, as Roles, groups and permissions shows. Without it, “System Logs” does not appear under “System”.
• No technical knowledge. You only read, filter and download; nothing on this screen changes your data.

Open it and read a row

1. 1

   Step 1: Open System Logs

   Go to SystemSystem Logs. The page is titled “Audit & System Logs”. It opens on the last 30 days, newest first.

   A line above the table says what you are looking at, for example the number of days shown, how many entries match, and how many days entries are retained. The page refreshes itself every 30 seconds; click the “Refresh Logs” arrow at the top right for a fresh reading straight away.

2. 2

   Step 2: Read the columns

   Each row is one thing that happened:

   • “TIMESTAMP”: when, with the time zone in the heading.
   • “LEVEL”: how serious. “INFO” is ordinary activity, “WARNING” deserves a look, “ERROR” means something failed.
   • “ACTION”: what happened, as a short code in capitals.
   • “USER”: the email address of the person who did it.
   • “DETAILS”: a sentence describing it.
   • “SOURCE”: the IP address it came from, when one was recorded.
3. 3

   Step 3: Open one entry

   Click a row. A panel titled “EVENT INTELLIGENCE” opens beside the table, or under it on a narrow screen. It shows the “FULL DETAILS”, and, when they were recorded, where the action came from (“ORIGIN”) and the browser and computer used (“DEVICE”). Click “Close” to put it away.

   Under “METADATA”, click the “CORRELATION ID” to show only the entries that belong to that one request. This is the same reference Zonitix support asks for; see Contact Zonitix support.

Find what you are looking for

1. 4

   Step 4: Use the filters

   The bar above the table has six filters. They combine, and the table updates as you set them.

   • “Severity”: “All”, “Info”, “Warning” or “Error”. The four tiles under the filters (“Total Events”, “Info Logs”, “Warnings”, “Errors/Critical”) do the same when clicked.
   • “User”: pick a person, or type part of an email address.
   • “Time Range”: “24h”, “3 Days”, “7 Days”, “30 Days”, “90 Days”, “1 Year” or “All Time”.
   • “Search”: words that appear in the details.
   • “Actions”: show only these kinds of event.
   • “Exclude”: hide these kinds of event.

   The kinds of event include “Sign-ins (all)”, “Failed sign-ins”, “MFA”, “Users”, “Permissions & roles”, “Denied / blocked”, “Elevation (sudo)”, “Workflows”, “Automations”, “Sync”, “Finance”, “Signatures”, “Compliance”, “Audit” and “Licensing”.

   Every filter you set appears as a small label after “Filters:”. Click the cross on a label to remove that one, or “Clear all” to remove them all. The time range always stays.

2. 5

   Step 5: Or ask in plain English

   Type a question into the box that begins “Ask in plain English”, such as “failed logins in the last week”, and click “ASK AI”. The examples under the box (“Failed logins”, “Permission changes”, “Denied actions” and others) fill it in for you.

   The AI model inside your own instance turns the question into the filters from step 4, which you can then see and change. It does not read or change the log itself.

Keep a copy and check it

1. 6

   Step 6: Export what you see

   Click the download arrow at the top right (“Export current view to CSV”). You get a CSV file of every entry that matches your filters, not only the page on screen. The export is itself recorded in the audit log, as a “WARNING” entry with the action “AUDIT_LOG_EXPORTED”; that is expected.

   A very large export stops at the newest 50,000 entries. The file then contains a line beginning “INCOMPLETE EXPORT” that says so; narrow the time range or the filters and export again to get the rest.

2. 7

   Step 7: Check nothing was tampered with

   Click the shield at the top right (“Verify the audit trail hasn’t been tampered with”). Each entry is linked to the one before it, so a changed or removed entry breaks the chain. A green label beginning “Chain verified” with the number of entries means the chain is whole.

Decide how long entries are kept

1. 8

   Step 8: Set the retention

   Go to Security & ComplianceSecurity SettingsAudit Log Retention (in the “Platform” group). “Keep audit entries for” offers periods from “90 days” to “10 years”. It is 90 days until someone chooses; the label next to the heading reads “Using default” until then, and “Set by admin” afterwards. Click “SAVE SETTINGS” to apply it. This screen needs the right to manage security settings.

   Two rules always hold: nothing younger than 90 days is deleted, and nothing is deleted until an archive of it is confirmed in your off-box backup destination. With no off-box destination, entries are kept indefinitely. See Set up backups.

What you should see

If something goes wrong

System Logs is not in the left menu.

Your role cannot view logs. Ask an administrator to open the page for you, or to give your role that right.

"No matching entries"

The message names the filters and the period it searched. Click "Widen to …" to look further back, or "Clear filters". Entries older than your retention period may no longer be in this list.

ASK AI shows a warning, such as "Could not interpret that."

Rephrase the question, or set the filters by hand as in step 4. If AI is switched off for your company, the filters still work; see Turn AI on or off and choose the model.

The export shows an error and no file is downloaded.

The message says why. If the export took too long, narrow the time range or the filters and try again.

"Could not run the verification, so the audit trail was NOT checked"

The check did not finish; this is not a result about your data. Click "Try again".

A red label reads "TAMPERING DETECTED" or "Chain verification failed".

Do not dismiss it. Note exactly what the label says and the time, take a screenshot, and contact Zonitix support straight away.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Forward logs to your SIEM
• Export all your company data
• Roles, groups and permissions