Audit Log
Billing
Subscription ManagementAudit Log
Access:Super Admin
The Audit Log provides a complete, immutable record of all security events and data operations in your SanctuaryOS account. It is the primary tool for investigating suspicious activity, verifying compliance, and understanding who did what and when.
Getting Here
Navigation: Settings → System → Audit Log
Audit Tabs
The audit log is divided into two tabs:
| Field | Type | Description |
|---|---|---|
| Security Events | Tab | Authentication-related events: logins, logouts, MFA verifications, session invalidations, password resets, and token refreshes. |
| Operations | Tab | Data modification events: record creation, updates, deletions, posts, locks, merges, and imports across all modules. |
Security Event Types
| Field | Type | Description |
|---|---|---|
| LOGIN_SUCCESS | Blue | A user successfully logged in. Shows the user's email address. |
| LOGIN_FAILURE | Red | A login attempt failed (wrong password, locked account, etc.). Shows the attempted email. |
| LOGOUT | Gray | A user logged out normally. |
| MFA_SUCCESS | Green | A user passed multi-factor authentication verification. |
| MFA_FAILURE | Red | A user failed MFA verification (wrong code, expired token). |
| SESSION_INVALIDATED | Amber | A user's session was forcefully terminated (admin action or security policy). |
| PASSWORD_RESET_FORCED | Purple | A password reset was forced for a user (admin action or policy expiry). |
| TOKEN_REFRESH | Blue | A user's authentication token was refreshed (normal background operation). |
Operations Event Types
| Field | Type | Description |
|---|---|---|
| CREATE | Green | A new record was created (member, transaction, service, etc.). |
| UPDATE | Blue | An existing record was modified. |
| DELETE | Red | A record was deleted or soft-deleted. |
| POST | Green | A batch or session was posted (finalized). |
| LOCK | Amber | A record was locked to prevent further modification. |
| MERGE | Purple | Two records were merged (e.g., duplicate members). |
| IMPORT | Blue | Data was imported from an external source (CSV, integration). |
Entry Details
Each audit log entry contains:
| Field | Type | Description |
|---|---|---|
| Timestamp | DateTime | When the event occurred. Displayed as relative time for recent events ("Today 2:30 PM", "Yesterday 9:15 AM") and absolute date for older entries. |
| Event Type | Badge | Color-coded badge identifying the event type. |
| User | Email | The email address of the user who performed the action. |
| IP Address | Text | The IP address the request originated from. Useful for identifying unusual login locations. |
| Browser | Text | Detected browser (Chrome, Firefox, Safari). Derived from the User-Agent header. |
| Metadata | JSON | Additional context about the event (varies by event type). Available in CSV exports. |
Filtering
Use the filter controls at the top of the log to narrow results:
| Field | Type | Description |
|---|---|---|
| Event Type | Dropdown | Filter by a specific event type (e.g., show only LOGIN_FAILURE events). |
| Date Range | Dropdown | Last 7 days, Last 30 days, Last 90 days, or All time. |
Exporting
The audit log can be exported for external review or compliance purposes:
- Export CSV — Downloads all currently filtered entries as a CSV file with columns: Date, Event, User, IP Address, and Details (metadata as JSON)
- Print / Save as PDF — Opens a print-friendly view of the filtered entries, which can be saved as PDF through the browser's print dialog
Pagination
The audit log loads 50 entries at a time. If more entries match the current filters, a Load More button appears at the bottom to fetch the next batch.