Audit logs

The audit log is the record of who did what in your workspace, and when. Use it to find out who removed a document, who invited a colleague, or whether someone has been trying to sign in and failing.

Open it from Audit Logs under ACTIVITY in the sidebar.

Who can read it

Two things decide this: your plan and your permission.

Plan. Reading the log is on Professional. On Business the page explains this and offers an upgrade. Your workspace is still recording every action, and keeps the last 30 days, so upgrading does not start you from zero.
Permission. The log includes what admins did, so the workspace owner decides which admins can read it. The owner always can. For another admin, the owner turns on Audit Logs for their account type on Accounts under PEOPLE. See Account types. Until then the sidebar row is dimmed, with a tooltip naming the owner, and opening the page says You don't have access to Audit Logs.

Entries are kept for 365 days on Professional.

What is recorded

The log covers sign ins, document changes, teammate invites and removals, integrations being connected, expert changes, questions asked, handoff requests, billing and security events, including your own actions and other admins'. Each entry has a person (or key, or system process) behind it, shown in the Who column.

It does not store what was said in a chat. For an event where someone asked a question, the entry links to the conversation in History instead, where it follows History's own retention.

Importance

Every event type has an importance level, so you can look at the serious ones first. The question mark beside Importance on the left explains the levels. Click a level to filter the log to it. Any importance removes the filter.

Level	What it means
Critical	Something was destroyed or handed over and cannot be undone here: an expert, a company, an account, ownership or the plan.
Warning	Something was refused or failed, such as a sign in, an API key, a plan limit, a blocked address or the usage ceiling. Nothing changed, but somebody was stopped.
Notable	A deliberate change to what the workspace holds or who can reach it: documents, teammates, roles, integrations or keys.
Routine	Ordinary use that leaves a trace, such as signing in, asking a question, opening a document or renaming something.

The level belongs to the type of event, not to each occurrence. A failed sign in is a Warning whoever it was. Deleting one document is Notable, but deleting the expert that held it is Critical, because everything under it goes too.

Finding an event

The Category list on the left groups events by area, with a count for each: sign in, People, Knowledge, Experts, Chat, Integrations, Handoff, Dashboard, Billing, Security, Support, System and Audit. Categories with nothing in them are left out. All activity shows everything.
The Anyone drop down filters to one person.
The date picker sets the period. It opens on the last 30 days. Presets run up to All time and Last 12 months, and the button beside it takes you back to the last 30 days.
The search box, Search people, files, events…, matches names, file names and event descriptions.
The rows drop down shows 20, 50 or 100 per page.

The counts on the left follow your date range and your other filters, so they always describe what is in the table.

Reading an entry

The table has five columns. When is the date and time. Who is the person's name with their email beneath. What happened is a plain description and the event type. Importance is the level. From is the IP address the action came from.

Click a row to open its details. You see who did it, their email, their account type (Member, Admin, Agent, API key, Visitor, Support or System), the event, its importance, what it was done to, the IP address, the device, and any extra details that were recorded. Agent is a person whose account only answers handed over chats. If the entry is about a question someone asked and it can be traced, View this conversation opens it in History.

Exporting

Click Export CSV on the left to download the entries that match your current filters. The file opens in a spreadsheet and has one row per event. The columns are when, who, who_email, who_type, event, what, target, severity, ip and details. The type column uses the same names as the details panel, such as Member, Admin or Agent.

The importance level is written as critical, warning, notice or info. These match Critical, Warning, Notable and Routine on screen.

The file holds up to 5,000 rows. If more entries match, the last line of the file starts with TRUNCATED and says how many rows matched and how many were exported. Narrow the filters, for example to a shorter period, and export again.

Exporting is itself recorded in the log.