The audit log

The audit log answers one question: who did what, and when. It is the place to look when a monitor has been switched off, a subscription has changed, or you simply want to see who has been signing in.

Who can see it

Admins only. The page sits behind an admin-level check, and the Audit Log link lives in the Admin group of the sidebar, which is only drawn for admins. Owners count as admins, so the account owner sees it too. A staff member has no link and no access. See Team members and user roles.

Free accounts do not have this screen at all. The free plan is not allowed past its own short list of pages, and the audit log is not on it.

The team table

Every member of the organisation, whether or not they have ever signed in. For each person you get their name and email, their role, the date and time of their last sign-in, the address they signed in from, and the date they joined. Someone who has never signed in shows Never rather than a blank.

The last sign-in time is recorded directly against the user when they log in, so it is always current. It is not one of the events in the list below, which is worth knowing: the event list does not carry sign-ins, and the team table is the only place they appear.

What gets recorded

The event list is written to whenever something worth remembering happens. The main kinds are:

• Monitoring toggles. Turning a check on or off for one site, named by site and check. Bulk changes are recorded too, as a single entry naming the check and how many sites it touched.
• Subscription and payment events. A subscription activated, a plan change, a cancellation, a successful payment and a failed payment. These come from the payment provider rather than from a person, so they show without a name against them.
• Scan credit purchases. Buying a credit pack. See Scan credit packs.
• Team changes. An invitation being accepted.
• Renewals. A renewal added, confirmed or deleted. See Domain expiry and renewals.
• Domain records. Notes added to a site, valuations run, and watchlist domains added, removed or acquired.
• Organisation settings. A change to your client portal address.

Support staff acting on your account are logged too, including when an administrator starts and stops signing in as one of your users, so that never happens invisibly.

Finding one thing

1. 1
   Pick a user to see only what one person did. The list is your current team members, the same people shown in the table above.
2. 2
   Type into action to match part of an action name. It is a partial match, so monitor finds both single and bulk monitor changes, and payment finds payments received and payments failed.
3. 3
   Choose a time range: 7 days, 30 days, 90 days or the last year. Thirty days is the default.
4. 4
   Press Filter. A Clear link appears next to it once a user or action filter is active.

Reading an entry

Each entry carries the person who did it, a coloured label for the kind of action, a one-line description written at the time, the date and time, and the address the request came from. The description is the useful part: it names the site and the check, so Disabled uptime monitoring on example.com tells you what happened without needing to look anything up.

The address is resolved through the trusted proxy in front of the application, so it is the real visitor address rather than the proxy's own. Events raised by the payment provider carry no person and no address.

Where to find this

Good to know

• The log is per organisation. It never shows activity from another account.
• Entries are written as things happen and are not editable from the dashboard.
• An entry with no name against it came from the payment provider, not from a person.
• If you are chasing a missing alert rather than a change, the notification log in Settings is the better place to look.