--- title: "Audit log" slug: admin/audit-log url: https://projectri.com/docs/admin/audit-log section: admin audience: admin app_route: "/[slug]/admin/audit-log" permissions: [security.audit_export, security.policy] plan: enterprise.audit_export mobile: "/admin/audit-log" updated: 2026-09-08 source: Projectri documentation --- # Audit log Every recorded action in this workspace, who did it and from where, with a bulk export and streaming to your own SIEM. ![Audit log](https://projectri.com/docs-shots/admin-audit-log.png) ## What it is The audit log is the record of what happened in this workspace: invitations, role changes, suspensions, removals, sign-ins, policy edits and every other action that changes something. Two tabs — **Entries**, the feed itself, and **Streaming**, where you point that feed at your own security tooling. ## How to get there **Security → Audit Log** in the admin console. The feed is ADMIN-only: the trail names who suspended whom and from which address, which is material a member has no business reading about their colleagues. - **Export** needs `security.audit_export`. A person without it gets a refusal from the route rather than a hidden button, because a missing control is indistinguishable from a missing feature. - **Streaming** — adding, editing and pausing a destination — needs `security.policy` *and* the `enterprise.audit_export` entitlement. The export file itself is not entitlement-gated; the pipe is. ## How to use it ### Read the feed 1. The **Entries** tab lists the newest rows first: the action, the person or **System**, the target, the time and the address. 2. **Filter by action** matches an action *namespace*, so typing `member.` returns every member action and `member.invite` does not also return `member.invite_cancel`. 3. **Load more** pages backwards by cursor rather than page number, so rows written while you read cannot be repeated or skipped. ### Export a range 1. Press **Export**. The dialog opens seeded with whatever filter is on screen, so the file matches the list. 2. Pick a **from** and **to** date. `from` is inclusive at both ends, and a backwards range is refused here rather than returning an empty file that reads like a quiet period. 3. Choose a format: **CSV** (the default), **JSON**, **NDJSON** or **CEF** — the same three shapes the streaming destinations accept, plus CSV for whoever is opening it in a spreadsheet. 4. The file downloads and the dialog reports the row count. Zero rows is an answer, not a failure. 5. If the export hit the **50,000-row cap** the dialog says so and offers the next range, rather than leaving you to work out an off-by-one. ### Stream the log to a SIEM 1. Open **Streaming** → **Add destination**. 2. Choose a kind: **Generic HTTPS collector**, **Splunk HTTP Event Collector**, **Datadog Logs**, or **S3-compatible object storage**. 3. Choose a format — JSON, NDJSON or CEF — and optionally a list of action prefixes so only part of the log is sent. 4. Save. Every kind except generic HTTPS needs a credential; the card says whether one is present. 5. Press **Send test**. On success it reports the size and HTTP status; on failure it shows the far side's own words, because a generic "delivery failed" would leave you guessing between a wrong token, a wrong index and a firewall. ### Check that the feed is healthy Each destination carries one word: **Healthy**, **Nothing sent**, **Failing** with a count, **No credential**, **Off**, or **Parked**. Expand the card for the delivery history, which includes the `EMPTY` attempts — a history of only non-empty deliveries cannot tell a quiet Tuesday from a broken feed. ### Restart a parked destination A destination that failed repeatedly stops itself and will not resume on its own. The card states why in a sentence rather than a badge. Fix the far side, then use the **Streaming** toggle to switch it back on. ## What it affects - **Nothing in the workspace.** The feed is a record; reading, exporting or streaming it changes no data. - **What your security team sees.** A destination that is off, parked or missing a credential is silence at the other end, and silence is a SIEM feed's characteristic failure — every dashboard stays green and the gap is discovered during the incident it was supposed to cover. - **Deleting a destination** stops delivery from that moment. Rows already delivered stay where they went. ## On mobile `/admin/audit-log` in the Expo app is the feed, read-only, with the action filter as a chip strip and the same cursor paging. `/admin/audit-stream` carries the health half: read a destination's state, send a test event, pause or resume. Composing a destination and exporting a file stay on the web. ## Limits and gotchas > [!WARNING] > An export stops at 50,000 rows. A tenant with years of history has far more, > and a file that quietly stopped at the cap is worse than a refusal, because > somebody hands it to a regulator believing it is the whole record. The dialog > reports the cap when it is hit — take the next range it offers. - The resume point an export offers is the **last row's timestamp**, not the row after it, so consecutive ranges overlap by one instant on purpose. A duplicate row in an export is visible to whoever reads it; a missing one is not. - Streaming needs the ENTERPRISE `enterprise.audit_export` entitlement. Without it the tab loads but no destination can be created. - The **Entries** feed is ADMIN-only. A delegate holding `security.view` can reach [Security](/docs/admin/security) but not this page. - A destination's delivery history counts attempts, not events: an attempt that carried nothing is recorded as `EMPTY` rather than dropped. ## Related - [Security](/docs/admin/security) — the sign-in log, which is a different record from this one. - [Privacy](/docs/admin/privacy) — data-subject requests, retention and legal holds. - [Members](/docs/admin/members) — the screen most of these rows are about. - [Exports](/docs/features/exports) — the other ways data leaves Projectri. ## Related - [Security](https://projectri.com/docs/admin/security.md): The sign-in rules this workspace enforces, who is signed in, what machine credentials and outside applications can reach it, and the sign-in history. - [Privacy](https://projectri.com/docs/admin/privacy.md): The data-subject request queue with its statutory clock, how long each category of data is kept, legal holds that suspend deletion, and where this workspace's data lives. - [Members](https://projectri.com/docs/admin/members.md): The workspace roster and the pending invite list — invite people, change roles, suspend, remove, and do any of those to many people at once. - [Exports and downloads](https://projectri.com/docs/features/exports.md): What you can take out of Projectri, in which formats, who is allowed to, and what a download deliberately leaves behind.