Skip to content

Audit Logs

The Audit Logs page in the Admin Panel provides a chronological, tamper-resistant record of every administrative action performed on your SetGet instance. Audit logs are essential for security monitoring, compliance audits, incident investigation, and operational accountability.

Navigate to Admin Panel > Audit Logs or go directly to /backoffice/logs/audit.

What gets logged

SetGet records audit log entries for the following categories of actions:

Settings changes

ActionDescription
settings.general.updatedGeneral settings (name, URL, branding) changed
settings.smtp.updatedSMTP configuration changed
settings.smtp.testedSMTP test email sent
settings.auth.updatedAuthentication settings changed
settings.security.updatedSecurity settings changed
settings.storage.updatedStorage configuration changed
settings.storage.testedStorage connection tested
settings.ai.updatedAI configuration changed
settings.features.updatedFeature flags toggled
settings.gdpr.updatedGDPR/KVKK settings changed
settings.email_template.updatedEmail template modified
settings.email_template.resetEmail template reset to default

User management

ActionDescription
user.createdNew user account created by admin
user.updatedUser profile modified by admin
user.role_changedUser's instance role changed
user.deactivatedUser account deactivated
user.reactivatedUser account reactivated
user.deletedUser account permanently deleted
user.sessions_terminatedUser's sessions force-terminated
user.password_resetAdmin initiated a password reset for a user
user.bulk_deactivatedMultiple users deactivated in bulk
user.bulk_deletedMultiple users deleted in bulk

Workspace management

ActionDescription
workspace.suspendedWorkspace suspended
workspace.resumedWorkspace suspension lifted
workspace.ownership_transferredWorkspace ownership changed
workspace.deletedWorkspace permanently deleted

GDPR / Compliance

ActionDescription
gdpr.export_requestedUser data export initiated
gdpr.export_completedUser data export ready for download
gdpr.deletion_requestedUser data deletion initiated
gdpr.deletion_completedUser data deletion completed
gdpr.consent_updatedConsent configuration changed
gdpr.retention_updatedData retention policy changed

Authentication events

ActionDescription
auth.oauth_provider_enabledOAuth provider enabled
auth.oauth_provider_disabledOAuth provider disabled
auth.saml_configuredSAML settings updated
auth.ldap_configuredLDAP settings updated
auth.signup_toggledSign-up enabled or disabled

Log entry format

Each audit log entry contains the following fields:

FieldDescriptionExample
TimestampWhen the action occurred (ISO 8601, UTC)2026-03-29T14:23:01Z
ActorUser who performed the action (name and email)John Doe (john@example.com)
Actor IPIP address of the actor203.0.113.10
ActionMachine-readable action identifieruser.deactivated
Action LabelHuman-readable descriptionUser deactivated
TargetEntity affected by the actionjane@example.com
Target TypeType of the target entityuser, workspace, settings
DetailsAdditional context (JSON){"previous_role": "user", "new_role": "admin"}
Request IDUnique identifier for the API requestreq_abc123def456

Viewing audit logs

The audit log page displays entries in reverse chronological order (newest first). Each entry shows:

  • Timestamp and relative time ("2 hours ago")
  • Actor name and avatar
  • Action description in human-readable form
  • Target entity with a link (when applicable)
  • Expandable details section for the full JSON payload

Searching and filtering

Use the search bar to find entries by:

  • Actor name or email
  • Target name or email
  • Action identifier
  • Free text in the details field

Filters

FilterOptions
Date rangeStart and end date/time pickers
ActorSelect a specific user
Action categorySettings, User Management, Workspace Management, GDPR, Authentication
ActionSpecific action type from the dropdown
Target typeUser, Workspace, Settings
IP addressFilter by actor's IP address

Combined filters

Filters can be combined to narrow results. For example:

  • Show all user.deleted actions in the last 30 days.
  • Show all actions by a specific admin user.
  • Show all settings changes from a particular IP address.
  • Show all workspace management actions for a specific workspace.

Exporting audit logs

Export audit logs for external analysis, compliance audits, or archival.

  1. Apply any desired filters to narrow the scope.
  2. Click Export at the top of the log list.
  3. Choose the export format:
FormatDescription
CSVComma-separated values, compatible with spreadsheets
JSONFull JSON records with all metadata
  1. Click Download.

The export includes all fields for each log entry within the filtered scope.

TIP

For regular compliance reporting, schedule monthly exports of audit logs filtered to the relevant action categories. Store exports in a secure, tamper-evident location.

Retention period

Audit logs are subject to the data retention policy configured in GDPR / KVKK settings.

SettingDefaultConfigurable
Audit log retention365 daysYes
Minimum retention90 daysCannot be set lower

WARNING

When the retention period expires, audit log entries are permanently deleted by the nightly cleanup job. Export logs before the retention period ends if you need to keep them longer.

Log integrity

Audit log entries are append-only. Once written, they cannot be modified or deleted through the Admin Panel or API (except by the automated retention cleanup). This ensures the reliability of the audit trail for compliance and investigation purposes.

TIP

For additional tamper protection, consider forwarding audit logs to an external SIEM or log management system (Splunk, ELK, Datadog) in real time.

Common audit queries

QuestionHow to find the answer
Who changed the SMTP settings?Filter: Action = settings.smtp.updated
When was a user deleted?Filter: Action = user.deleted, Target = user email
What did a specific admin do this week?Filter: Actor = admin email, Date = last 7 days
Were any workspaces suspended?Filter: Action = workspace.suspended
Who enabled GitHub OAuth?Filter: Action = auth.oauth_provider_enabled
Were there any GDPR deletion requests?Filter: Action category = GDPR