Help: Audit log
The Architect. The audit log (/razadmin/audit) is one record per event, append-only, never edited: who, what, when, which project, its code and severity. Critical only shows the few codes listed in Settings:System events.critical. Everything noisier is in the detailed log (Logs).
Retention and the archive
- Kept in the database: 30 days (
audit-keepinSettings:System). - Archived: daily at 03:15 (and on demand: Archive now on this page), records from whole days (UTC) older than that move, per project, to that project's Files, folder
_archive/, as one file per run:audit-<first day>--<last day>.jsonl.gz. Records that belong to no project go to base d2's files. A day that hasn't ended (at midnight UTC) is never archived. - How: up to 50,000 records a run, 1,000 at a time; each file is checked before its records leave the database. If anything fails, nothing is deleted, the run is recorded as an error (
A_ARCHIVE) and the Architect is alerted. - The file: gzipped JSON Lines, one record per line; opens with any gunzip. The archived view on this page reads them back.
- Archive files stay in the project's
_archive/folder until its archive size quota is reached; then the oldest are deleted first.