Audit Logs
==========

The audit log records security-relevant changes in your Zammad instance: who
changed what and when. You can find it under *System > Audit Logs*. The
``admin.audit_log`` permission is required to access it.

The audit log is read-only. It does not record day-to-day ticket updates. For
those, see the ticket history.

What Is Recorded
----------------

The audit log records basically all actions where admin permissions are
required. No matter if a setting got adjusted or an object like a trigger got
touched.

Configuration adjustments and changes of data in the admin area:

- Groups, roles, and permissions
- Overviews, triggers, schedulers, macros, templates, text modules and checklist
  templates
- Channels, postmaster filters, signatures, LDAP sources and webhooks
- Calendars, SLAs, time accounting, core workflows, object attributes, public
  links and report profiles
- System settings and packages
- AI agents and AI text tools
- S/MIME, PGP and SSL certificates
- Knowledge bases and their languages

User account changes (only changes for agents and admins accounts are recorded):

- Password changes
- Activation and deactivation of accounts
- Added or removed roles and group permissions
- Two-factor authentication changes

Session events:

- Taking over another user's session via ``View from user's perspective`` and
  switching back

Viewing Audit Log Entries
-------------------------

By default, the audit log is sorted by **Created at**, with the newest entries
shown first. The **Created at** timestamp indicates when the audit log entry
was created, not when the affected object was created. Click any column heading
to change the sort order. Use the **Search for audit logs** bar to find entries.
The list displays the following information:

User
   The user who performed the action.

Action
   The action that was performed. Available actions include **create**,
   **update**, **destroy** (delete), **switch to user** and
   **switch back to user**.

Object
   The type of object that was changed.

Object name
   The name of the object that was changed.

Source IP
   The IP address from which the action was performed.

Created at
   The date and time when the entry was created.

Clicking an entry opens a read-only dialog with the recorded changes. Lines
prefixed with ``-`` and highlighted in red show previous values. Lines prefixed
with ``+`` and highlighted in green show new values. Session takeover entries
show **No changes** because they record the event rather than an object change.

Retention
---------

Zammad automatically removes audit log entries older than 12 months. This
retention period is not configurable. The cleanup runs once a day.