Audit
Audit is the structured history of authenticated actions, targets, methods, sources, outcomes, and technical context.
Where to find it: SDM root sidebar > Audit.
Available to: root.
What this page does
Use Audit to answer who did what, from which authentication source, against which resource, and whether it succeeded. It is the change-investigation view; service output and operating-system messages belong in Logs.
Before you start
Know an approximate time, actor, zone, action, method, or authentication source. Displayed timestamps follow the configured timezone. Retention may limit how far back the search can go.
Filters and exports
- Search text plus authentication sources
session,system,db,external_api,cluster_api,cluster_token,cluster, orapi. - Method filter and tabs for GET, POST, PUT, PATCH, and DELETE, plus date range.
- Row details provide the readable event and a technical view.
- Export the current filter as CSV or JSON.
- Read state and Auto-read this tab are per operator/browser behavior; auto-read is for reviewing a stream, not deleting evidence.
- Retention and Prune now remove events outside the configured window; use Server Audit Settings for the full policy.
Controls and fields
| Control, Field, Or Section | What It Does | What It Affects | Recommended Usage |
|---|---|---|---|
| Search audit | Searches audit rows by visible/request metadata. | Filters displayed audit evidence. | Use with method/date filters during incident reconstruction. |
| Auth source filter | Limits events by authentication source when available. | Separates panel, API, and system-originated actions. | Use to distinguish manual UI changes from automation. |
| Method filter and method tabs | Filters and groups audit events by HTTP method: GET, POST, PUT, PATCH, DELETE. | Makes read actions and mutating actions easier to inspect separately. | Start with POST/PUT/PATCH/DELETE for change investigations. |
| Date from / Date to | Limits audit events to a time window. | Reduces noise and aligns events with customer incident times. | Set both bounds before exporting support evidence. |
| Only errors | Shows failed audit events only. | Highlights denied, validation, or backend failures. | Use when users report an action did not work. |
| Apply | Applies the current filters. | Reloads audit rows according to the selected criteria. | Apply after setting every relevant filter. |
| Reset | Clears audit filters and returns to default method view. | Removes hidden filter state. | Use before a new investigation. |
| Refresh | Reloads current audit rows. | Does not change filters or audit data. | Use while reproducing a problem. |
| CSV / JSON export choices | Selects one or both export formats. | Controls downloaded evidence format. | CSV is useful for spreadsheets; JSON is better for technical support escalation. |
| Export | Downloads filtered audit data in selected formats. | Creates evidence outside the UI. | Export before pruning or before closing a security incident. |
| Mark current tab as read | Stores current method-tab entries as reviewed in browser state. | Changes local read state only. | Use to track what has already been reviewed by the operator. |
| Auto-read this tab | Automatically marks rows read while browsing that method tab. | Changes local read state only. | Use for high-volume read-only reviews, not for security triage where unread state matters. |
| Details | Opens a modal with summary cards, changes JSON, and full event JSON. | Reveals request ID, node, user, source IP, method, path/action, status, success flag, user agent, and payload details where available. | Copy request ID, timestamp, username, path/action, and error into support tickets. |
| Previous / Next | Pages through method-specific audit rows. | Changes visible page of evidence only. | Use after narrowing filters so pagination stays meaningful. |
Practical guidance
- Use audit filters before support escalation. Include timestamps, username, method, path/action, request ID, and error message when contacting support.
How to use it
- Set the narrowest time and method/source filters.
- Search by actor, zone, action, or error text.
- Open the row details and technical payload.
- Export the filtered evidence when it belongs in an incident record.
- Correlate service failures with Logs and current resource state.
Result and next check
You have a timestamped, actor-linked explanation of the requested operation and outcome. If no successful event exists, check login/API rejection paths and service logs rather than assuming the action ran.
Theme color