Audit logs

2026年10月21日公開

An install keeps two audit logs that never share entries: the Platform Console's, for what operators and publiractl change, and each tenant's, for what its staff change in the tenant console. Entries are never deleted, and neither log can be exported.

The Platform Console's log

Audit logs, under Governance in the Platform Console, lists the newest entries first, 20 to a page. Every operator can read it, an Auditor included. Each entry shows the Time, the Actor with their role, the action with its outcome, and the Target. A change made from publiractl names no operator: its actor is Command line. The list can be narrowed to one actor by public ID and to one kind of action, but not to a date. View audit logs on a tenant's page opens it narrowed to that tenant as well: the entries that changed the tenant, its invitations, or the accounts of its staff and readers. The tenant is named above the list, and its close button drops that filter alone; Clear drops every filter.

It records:

• Operators: added, changed, suspended, reactivated, and deactivated; and each operator's own two-step verification: set up, a code asked for at sign-in, whether right or wrong, a sign-in with a recovery code, new recovery codes, and turning it off.
• Platform settings and services: each save of the general settings, the security and community policy, the retention defaults, the email, storage, and search settings, and the Web Push contact, and each test of the email, storage, and search connections, with its outcome.
• Tenants and their staff: tenants created, changed, suspended, and resumed; administrators invited, and invitations resent and canceled; members added, created with a password, given a new role, and removed.
• Readers: accounts suspended, restored, and deleted by an operator.

A tenant's log

Each tenant's Audit logs, under Administration in its console, records what its staff do there, two-step verification included, and only its Tenant admins can read it. What it records is in Audit log. It cannot be read from the Platform Console, and what you change for a tenant from the Platform Console or publiractl is recorded in the Platform Console's log, not the tenant's.

What neither log records

• Signing in with a password. Neither a successful sign-in nor a wrong password leaves an entry; a tenant's log records only the two-step verification step that follows. publira server logs every attempt to sign in to the site, a tenant console, or the Platform Console as a line beginning audit auth, with the action, the outcome, the reason, and the client address, such as audit auth action=admin_login outcome=failure ... reason=invalid_credentials. Keep the server's log if you need that record.
• The install's secrets and variables. Rotating a key, a password, or a token happens outside Publira and leaves no entry anywhere. Keep your own record of when you rotated what.

Every entry is also written to the log of publira server as a line with msg=audit, before it is stored. Most entries are stored a moment after the change, from a queue in the server's memory, and an entry that cannot be stored after a few attempts, or that is still queued when the server stops, is dropped from the console's list but stays in that log line. Monitoring names the log lines and metrics to alert on for those drops.