FluxDeployDocs
Topics: Audit Log

Audit Log

The Audit Log is the Audit tab of the Core-only Activity page (/activity/audit) and records authentication events and administrative actions. The old /audit-log address still works and redirects here. Use it to investigate suspicious activity, confirm who changed a setting, or diagnose a lockout.

Summary Cards

  • Total Entries - All audit records currently retained
  • Last 24 Hours - Recent activity count
  • Auth Failures (24h) - Failed login attempts in the last day

What Gets Logged

The audit log captures events such as:

  • Successful and failed admin logins
  • Password changes
  • Session invalidations
  • Settings changes (organization, security, relay config, notifications)
  • User account create / edit / delete
  • SAML/SSO configuration changes
  • License upload and removal
  • API key regeneration
  • Certificate lifecycle (issued, renewed, activated, authority changes)
  • FluxDeploy updates: UPDATE_MANIFEST_REJECTED (a release was not offered because its signed manifest did not verify), UPDATE_STARTED, UPDATE_INSTALLED, UPDATE_FAILED - see Updating FluxDeploy
  • CERT_PIN_TRUSTED_ON_FIRST_USE - a relay auto-registered without verifying Core's TLS certificate, so its registration key and issued API key crossed an unauthenticated channel and it pinned whatever answered. Confirm the thumbprint on that relay matches Core's; see Relay Sites.

Each entry records timestamp, actor (username or IP for unauthenticated attempts), action, resource, and a short description.

Filtering

The filter bar supports:

  • Search text - Matches actor, action, or resource
  • Quick-filter chips - the five event types this installation logs most often, so the shortcuts reflect what you actually see rather than a fixed list. They change as your usage changes.
  • Event type - the complete list of types present in the log, most frequent first. Anything not on a chip is here, so no event type is reachable only through a chip.
  • Origin - user actions, system actions, or anyone
  • Date range - Start and end date

The table is paginated; use the page controls at the bottom to move through large result sets.

Retention

Audit entries are retained indefinitely by default. They are not affected by machine retention settings. Plan for periodic database maintenance on long-lived installations.

Access

Admin and ReadOnly roles can view the audit log. The Operator role cannot: the tab is not offered to them, and the page refuses if reached directly.