Appearance
Audit logs Optional feature
Audit logs record important operations performed in your workspace. You can search them by period and conditions from global nav > Workspace settings > Audit logs. Only a Workspace Owner can view them (Workspace permissions).
TIP
This is an optional feature. Depending on your contract, it might not be available.
What's recorded
For the list of recorded events and the fields each event contains, see Audit event definitions.
Searching
- Go to global nav > Workspace settings > Audit logs.
- Specify the Period.
- To narrow the results, select Add condition, and then specify a field, an operator, and a value.
- Select Search.
To narrow the results further, you can add a value as a condition from a row in the results or from the event fields shown when you expand a row.
Search conditions
- Specify a field listed in Audit event definitions in dot notation, such as
actor.principal.uid. - Values are compared as strings.
- You can add up to 20 conditions. When you specify multiple conditions, the results include only events that match all of them (AND).
The following operators are available.
| Operator | Description |
|---|---|
| is | The value matches the specified value. |
| is not | The value doesn't match the specified value. Events that don't have the field are also included. |
| is any of | The value matches any of the comma-separated values. |
| starts with | The value starts with the specified string. |
| contains | The value contains the specified string. |
| does not contain | The value doesn't contain the specified string. Events that don't have the field are also included. |
| exists | The field has a value. |
| does not exist | The field has no value. |
Information in the list
| Column | Description |
|---|---|
| Time | When the operation was performed. |
| Actor | Who performed the operation. |
| Event / Resource | The event type (for example, notebook.rename) and the name of the resource. |
| Status | Success / Deny / Failure |
| IP | The IP address the request came from. |
The list shows the newest events first. Scroll down to load more.
New and legacy formats
Audit log records come in a new format and a legacy format. What you can search in global nav > Workspace settings > Audit logs are records in the new format, which started on September 15, 2026. For the recording period of each event, see Audit event definitions.
To review operations from before recording in the new format started, use the legacy audit logs. Open them from the legacy audit logs link in the description at the top of the audit logs screen. The legacy audit logs show operations as sentences in English, and you can search them by user, group, API key, or keyword.
Retention and export
- Records in the new format are retained for 3 years from the date they're recorded. Records in the legacy format are retained for 1 year from the date they're recorded (Limits).
- Export from the screen isn't currently available. If you need an export, contact Codatum support.