Who can use this

Audit Logs

The Audit Logs page gives you a chronological, read-only record of what happens across your organization: who did what, to which resource, and from where. Use it to investigate incidents, answer compliance questions, and confirm that a specific action took place. Nothing on this page changes your system; you can browse, filter, drill into individual events, and export what you find.

Grengin audit logs

Who can use this

You’ll find Audit Logs under Control Hub → Monitor → Audit Logs. The page appears in your sidebar if you have the View Audit Logs permission, or any other administrator permission. What you can actually see in the log is determined by your organization’s access rules, so two admins may see different entries.

Reading the log

The main table lists events newest first, with one row per action. Each row shows:

  • Timestamp — when the action happened
  • User ID — who performed it
  • Action — what they did (color-coded so creations, deletions, updates, logins, and sends stand out at a glance)
  • Resource Type and Resource ID — what the action affected
  • IP Address — where the request came from

While entries load, you’ll see a loading spinner. If no events match your current view, an empty-state message appears in place of the table.

Filtering the log

Use the Filters section above the table to narrow down what you’re looking at:

  1. Search by User ID — type a user’s ID to see only their activity. This filter applies a moment after you stop typing.
  2. Filter by Action — pick a single action type from the dropdown. Leave it on All Actions to see everything. The dropdown applies as soon as you choose.
  3. Start Date and End Date — set the range of dates you want to review. Each applies immediately when changed.

Notes on filtering:

  • Leaving a field blank simply means it doesn’t restrict the results — empty fields are ignored.
  • There’s no “clear all” button, so to reset your view, empty each field you’ve used.
  • On narrow screens (phones, small windows) the Filters section collapses behind a toggle so it doesn’t crowd the table. On a normal desktop window it’s always visible.

Inspecting a single event

To see the full detail behind any entry:

Grengin audit log expanded
  1. Click a row (or highlight it and press Enter or Space).
  2. The row expands in place to show the complete record: User ID, Action, Resource Type, Resource ID, IP Address, and User Agent, plus a detail inspector.
  3. In the inspector, switch between two views using the buttons on the right:
    • Visualized — a readable property-by-property breakdown (the default).
    • JSON — the raw event data.
  4. Where a detail contains a long list or nested object, only the first few items show at first. Use Show more to reveal the rest and Show less to collapse it again.

To close the detail, click the same row again. There’s no separate close button.

Exporting

You can export exactly what your filters currently show. In the page header:

  • Click Export CSV to download a spreadsheet-friendly file named audit-logs-<date>.csv.
  • Click Export JSON to download the same data as audit-logs-<date>.json.

Both export buttons use your active filters, so refine your view first to get the export you want. The buttons are disabled while an export is in progress and when there are no entries to export.

Moving through results

Results are paginated, with a fixed number of entries per page. A pagination footer appears only when there’s more than one page. Use Previous and Next to move between pages; the buttons disable automatically at the first and last page.

Good to know

  • This is a read-only viewer. The only thing you can “do” here is export, which produces a download — it never changes your system.
  • The action dropdown is populated from your system’s known action types. If that list can’t load, you’ll see a brief notification and the dropdown falls back to just All Actions — the main log still loads normally.
  • Actions that aren’t recognized still appear in the table; they show with a neutral badge and their raw action name.
  • The number of entries per page is fixed and can’t be changed from this page.
  • This page intentionally has no charts or metrics — it’s purely the activity trail. For usage trends and performance numbers, see the analytics and metrics pages below.
  • You can also reach this page from System Maintenance, which links here directly.