Audit Logs FAQ

FAQ on Audit Logs

Frequently asked questions on Audit Logs

Audit Logs provides visibility into user actions within a Site24x7 account for compliance and accountability. Here are a few common questions about Audit Logs answered.
  1. What is the difference between Audit Logs and Alert Logs in Site24x7?
    Audit Logs records user and system actions performed within your Site24x7 account, such as configuration changes, logins, and resource deletions. Alert Logs, on the other hand, captures notifications sent for monitoring events like threshold breaches and downtime notifications. Audit Logs is primarily used for accountability and compliance, while Alert Logs is used for incident tracking and response.
  2. Who can view Audit Logs?
    Audit Logs can be accessed by users with the Admin, Super Admin, or MSP Admin role. Custom role users can also access Audit Logs if they have been explicitly granted permission.
  3. Can I filter Audit Logs for a specific monitor or user?
    Yes. You can use the query-based filter to narrow down audit entries by fields such as Performed By, User ID, Resource Name, Monitor Name, Action, Source, IP Address, and more. This helps you isolate activity for a specific resource or user quickly.
  4. How far back can I search in Audit Logs?
    Audit activities from the last six months can be searched and filtered directly. To access data older than six months (up to 13 months), you must reindex the required date range before performing a search. Data older than 13 months is automatically removed.
  5. Can I export Audit Logs?
    Yes. You can export audit log data as a PDF or CSV directly from the query section. You can also email the results to yourself or your team.
  6. Can I get notified when a specific action is recorded in Audit Logs?
    Yes. You can create alert templates directly from the Audit Logs page to get notified when specific log conditions occur. Site24x7 also provides default quick templates for common scenarios, such as Recent Deletions, Recent Suspensions, Excessive Write Operations, Excessive API Requests, and User Activity.
  7. Can I see exactly what changed in a configuration update?
    Yes. Clicking any audit log entry opens a detailed panel that includes a side-by-side comparison of the old and new configuration parameters. You can use the Show changes only toggle to focus exclusively on the fields that were modified.
  8. Can I view Audit Logs for a specific monitor without navigating to the main Audit Logs page?
    Yes. You can access audit entries from the following pages:
    1. Direct navigation: Go to Admin > Operations > Audit Logs.
    2. From monitor detail pages: Go to Home > Monitors > select any monitor > Audit Logs.
    3. From Monitor Groups: Go to Home > Monitor Groups > select any monitor group > Audit Logs.
    4. From list and admin pages: On any monitor listing or admin configuration page, click the hamburger icon  next to a resource and select View Audit Logs to jump directly to audit entries for that resource.
    5. From Alarms: Go to Home > Alarms > Audit Logs.
    6. From Applogs: Go to Admin > Applogs > select the log type as Audit Logs.
    7. From other pages: You can access Audit Logs from other pages like Configuration Profiles and Dashboards. Click the hamburger icon  next to any resource on a listing page and select View Audit Logs.
  9. Can I add Audit Log data to a custom dashboard?
    Yes. You can create Audit Logs widgets on any custom dashboard by saving a search query and adding it as an AppLogs widget with the log type set to Audit Logs.
  10. Does Audit Logs capture actions performed via API or Terraform?
    Yes. The Source field in each audit entry identifies where the action originated—including the web console, mobile app, API, or Terraform—so API-driven and infrastructure-as-code changes are fully tracked and attributable.