---
title: "Audit logs"
description: "The two tamper-evident records the console keeps, of what people did in the console and of what endpoints changed on themselves, and how to search them."
url: "https://support.outpostplatform.com/depot/audit-log/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Settings > Audit logs in the Outpost console holds two hash-chained records: Console actions (what people, the system, and agents did) and Endpoint changes (every setting an endpoint applied, reverted, or corrected on itself). The page verifies each chain and reports Chain verified or Chain broken. Covers filters, saved views, and retention. Needs audit:read."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "audit:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/audit-log.md"
license: "CC BY 4.0"
---

# Audit logs

The console keeps two audit records: what people did in the console, and what
your endpoints did to their own settings. Both are hash chained, so the console
can tell you whether either has been edited. Use them to answer "who disabled
that account" or "why is this laptop's password policy different", and as
evidence for an auditor.

Both are on **Settings** > **Audit logs**, on two tabs: **Console actions** and
**Endpoint changes**. Every plan includes the audit log, including Home Lab.

## Who can read them

Reading either record needs `audit:read`. Among the built-in roles, the Owner,
Support Manager, Field Technician, and Support Rep hold it. The Accounting role
does not. Anyone without it sees **You do not have permission to read the audit
log. Ask an owner for the audit:read permission.**

The audit log is read only. Nobody can edit or delete an entry from the
console.

## The two records

| Tab | Records | Kept |
| --- | --- | --- |
| **Console actions** | Every action taken in the console by an owner or a technician, actions the system took on its own, and changes an agent reported from an endpoint. | Not pruned. |
| **Endpoint changes** | Every setting an endpoint applied, reverted, or corrected on itself, with what it was before. | Pruned after your compliance retention period. |

They are kept apart on purpose. A question about a person is answered by
**Console actions**, and a question about an endpoint by **Endpoint changes**. A
merged list would hold both answers and make each harder to find.

Neither record includes Outpost's own internal records, which belong to
Outpost.

## How the hash chain works

Each entry carries a hash of the entry before it. Editing, inserting, or
removing an entry anywhere in the chain changes every hash after it, so the
break can be found. Each tab checks its chain when it opens and shows the
result at the top:

| Shown | Meaning |
| --- | --- |
| **Chain verified,** followed by the number of entries | Every entry is intact. |
| **Chain verified from checkpoint** followed by an entry number and count | Older entries were removed by retention pruning, and everything from that checkpoint on is intact. The page adds **Older entries were removed by retention pruning below that checkpoint.** |
| **Chain broken at entry** followed by an entry number | The record was changed outside the console at that entry. Treat it as a security incident. |

## Search console actions

The **Console actions** tab lists entries with **When**, **Person**, **Action**,
**Target**, and **From**.

- **Find by target** matches the exact id of an endpoint, client, person, or
  profile. Paste the id from the page of whatever you are investigating.
- The filters narrow by **Source**, **Person**, **Action**, **Target type**,
  and **Recorded** date. **Source** is **Console**, **System**, or **Agent**,
  and on the MSP plan also **MSP technician** (your team working inside a
  client), **Client portal** (a client's portal user), and **Public link**
  (someone using a quote, project, or pay link). The **From** chips above the
  list set it in one step.
- The saved views are **Last 7 days**, which is the default, **Last 24 hours**,
  **Endpoint events**, and **Everything**. You can save your own views. They are
  private to you.
- **Endpoint event** and **Only actions that changed access or permissions**
  narrow the entries already on the page, not the whole log. Widen the dates to
  reach further back.

Select an endpoint event's action to see its details, including its severity
and the record the agent reported.

## Export console actions

On **Console actions**, select **Export CSV** or **Export JSON**. The file
holds the entries in the dates and **Source** you chose. Other filters do not
narrow it. The JSON file carries each entry's hash and the hash of the entry
before it, so an auditor can check the chain without the console.

## Search endpoint changes

The **Endpoint changes** tab lists entries with **When**, **Endpoint**,
**Setting**, **Change**, **Outcome**, and **Actor**.

- **Find by setting** matches a setting's catalog key exactly, such as
  `password.min_length`. Copy the key from the profile or from **Effective
  config**.
- The saved views are **Last 7 days**, **Last 24 hours**, **Changes that
  failed**, **Drift corrections**, and **Everything**.

Select a setting to see the policy the endpoint was applying when it made the
change.

## Related

- [Roles and permissions](/depot/roles-and-permissions/)
- [Profiles and policies](/automation/profiles/)
- [Compliance](/compliance/)