docs Audit Logs
Audit Logs
An instance-wide record of who did what, kept for a configurable number of days.
What Gets Logged
Actions users take in the dashboard or through the API are recorded (deploys triggered automatically by Git webhooks are not), grouped by area:
| Area | Actions |
|---|---|
| Authentication | login, logout, register, change password, update profile |
| Projects & members | create, update, status page update, delete; member add, role change, remove |
| Applications | create, update, delete, deploy (including rollbacks), start, stop, env var changes, domain add/remove, maintenance on/off |
| Databases | create, delete, start, stop, backup, restore, backup config changes |
| Compose stacks | create, update, delete, deploy, start, stop, restart, env var changes, domain add/remove |
| Scheduled tasks | create, update, delete, run now, one-off command |
| Game servers | create, update, start, stop, restart, delete, console commands, file write/upload/delete/rename/mkdir, backups and restores, mod changes |
| Instance | users, servers, SSH keys, notification channels, GitHub App (create, delete, sync), configuration export/import, instance settings |
Secret values are never written to the log: changing an instance setting records the key name, not its value, and a configuration export records the scope and whether secrets were included.
Log Details
Each entry includes:
- User — the user's ID and email at the time of the action
- Action — e.g. application.deploy or database.restore
- Resource — type, ID and name of what was affected
- Metadata — extra context as JSON (e.g. the domain added, the backup file restored)
- IP address of the request
- Timestamp
Entries are not linked to live records, so they survive the deletion of the user or resource they refer to — the stored email and resource name stay readable.
Viewing & Filtering
The Audit Log page is available to global Admins only — it spans every project. It shows event counts for the last 24 hours and 7 days and deploys in the last 7 days, and lets you search by user, resource or action, filter by resource type and action, and expand an entry to see its metadata. Results are paginated, 50 per page.
Client IPs: the IP comes from X-Forwarded-For only when TRUST_PROXY=true; otherwise the address of the direct peer is recorded, which behind Traefik is the proxy itself. Enable it only behind a trusted proxy, or clients could write any IP they like into the log. The stock docker-compose.prod.yml does not pass this variable to the API container — add it to the api service's environment block.
Retention & Cleanup
Once a day, around 04:00 server time, entries older than AUDIT_RETENTION_DAYS (default: 90) are deleted. The value is read when the API starts. With the stock docker-compose.prod.yml, setting it in .env alone has no effect: add AUDIT_RETENTION_DAYS: ${AUDIT_RETENTION_DAYS:-90} to the api service's environment and recreate the container.