Audit Log

A searchable, exportable record of every configuration change on your account — who did what, when, and from which IP address.

What is the audit log?

The audit log is an automatic record of the changes people make to your Enori account's configuration. Every time a monitor, alert channel, alert rule, escalation policy, on-call schedule, status page, maintenance window, team, or API key is created, updated, or deleted, Enori writes an entry that captures what changed, when, and from which IP address.

Example: "Who deleted the checkout-API monitor last Tuesday, and from where?" — open the audit log, search checkout, and you'll see the MonitorDeleted entry with its timestamp and source IP.

You don't turn it on and you don't configure it. It records in the background from the moment you start using Enori.

When to use it

Reach for the audit log when you need to answer "what changed, and who changed it?":

• Post-incident review — an alert stopped firing or a monitor went quiet. Check whether someone paused it, edited its alert rule, or deleted a channel.
• Security / compliance — demonstrate that changes to your monitoring setup are tracked and attributable. Export a CSV for an auditor or to attach to a compliance report.
• Debugging a "why did this change?" mystery — a status page suddenly dropped a component, or a maintenance window appeared you didn't expect. The log shows the action and the source IP.
• Change history for one thing — you want the timeline of edits to a specific monitor.

When it is not the right tool

• Uptime / downtime history — the audit log tracks configuration changes, not check results. For "was my site up at 3am?", use the monitor's own history and the dashboard.
• Incident timelines — incidents, acknowledgements, and resolutions live in the incident view, not here.
• Login / sign-in history — sign-in events are not recorded in the audit log today (see the FAQ).

How it works

The audit log is automatic and always on. There is no setup step, no toggle, and nothing to install.

Each entry records:

What gets recorded

Configuration actions across these areas:

Whose actions you see

By default you see your own actions — the changes made under your account. If you own a team and have shared monitors with it, switch to the Team activity view to see the actions any team member took on those shared monitors, filterable by who did them. (You only ever see activity on monitors you've shared — a member's actions on their own private monitors stay private.)

Finding your audit log

There's nothing to configure — just open it:

1. In the dashboard sidebar, click Audit Log (or search for it in the command palette).
2. The page loads with your most recent entries first, defaulting to the last 7 days.

Screenshot: the Audit Log page with the filter bar (category, date range, search) and the first few entries.

Reading the results

Entries are shown newest-first in a table with four columns:

Click any row to expand it. The expanded view shows:

• Entity Type — the precise kind of item (e.g. Monitor, AlertChannel)
• Entity ID — the item's identifier. For monitors, this is a link straight to the monitor's detail page.
• IP Address — the source IP of the request that made the change
• Changes — a change detail, shown when one was recorded for that action

The footer shows "Showing X of Y entries" against the full total, and a Load more button pulls in the next page.

Filtering and searching

Three filters sit at the top of the page. All three are applied across your whole retained history on the server — not just the rows currently loaded on screen — so a search finds a matching entry even if it's weeks back.

The search is literal — special characters like % or _ are treated as plain text, not wildcards.

Exporting to CSV

Click Export CSV (top-right) to download the log as a spreadsheet-friendly file.

• The export honours whatever category and search you currently have applied, plus the selected date range — so you can export exactly the slice you're looking at.
• The maximum export window is 90 days. (No plan retains more than 90 days, so a wider range would only ever return partial data.)
• The file includes these columns: Timestamp, Action, Entity Type, Entity ID, Entity Name, IP Address, User Agent, Changes.

The CSV is safe to open in Excel, Google Sheets, or Numbers — cell values are escaped so nothing is misinterpreted as a formula.

Retention and plans

How far back your audit history goes depends on your plan:

The page shows a "Your plan retains N days of audit history" note under the filters, and the date-range dropdown is capped to that window — a Base account won't be offered "Last 90 days", because there'd be nothing older than 7 days to show.

Older entries are removed automatically once they pass your plan's retention window. If you need a permanent record, export a CSV periodically before entries age out.

Tip: Upgrading your plan extends retention going forward. It does not resurrect entries that were already purged under the shorter window.

Notifications and real-time activity

The audit log is a passive record you review — it does not send you alerts when a change happens.

If you want to see changes as they occur, the dashboard's Recent Activity feed surfaces customer-visible configuration actions in real time. The audit log is where you go later to search, filter, and export the full history.

For alerting on monitor problems (downtime, SSL expiry, and so on), see your monitor's alert channels — that's a separate system from the audit log.

FAQ

Do I need to turn the audit log on?

No. It records automatically from the start. There is no setup, toggle, or configuration.

Why is the "Changes" detail empty on most entries?

Every entry always captures the action, the affected entity, the timestamp, and the source IP — that's the core record. A detailed change payload (the extra content in the Changes field) is only shown when one was captured for that action, so many rows won't have it. The action name plus the entity tell you what happened; the Changes field, when present, adds specifics.

Does the audit log record who logged in?

Not today. The log covers configuration changes (creating, editing, deleting monitors, alerts, status pages, teams, API keys, and so on), not sign-in events. Login-event coverage is on the roadmap.

Can I see what my teammates changed?

Yes. By default the log shows your own actions. If you own a team and have shared monitors with it, use the Team activity toggle to see the actions any team member took on those shared monitors, and filter by who performed them. You only see activity on monitors you've shared with a team — a member's actions on their own private monitors stay private. Note that a shared monitor's full history is visible, including changes made before it was shared.

Why can't I select "Last 90 days"?

Because your plan retains fewer days. The date-range options are capped to your plan's retention window (Base 7, Pro 30, Business 90 days). Upgrade to extend it.

What is the IP address I see on an entry?

It's the source IP address the change request came from — for example your office network, home connection, VPN, or, for a change made through the API, the IP of the machine calling the API. It's taken from the network connection itself, so it isn't something a request header can spoof.

Can I access the audit log through the API?

Yes — the same history is available programmatically. See the API Reference for the audit-log endpoints (an API key needs the audit:read scope).

How long are entries kept?

For your plan's retention window (Base 7 / Pro 30 / Business 90 days), after which they're purged automatically. Export a CSV if you need a longer-lived record.

Troubleshooting

Reference: at a glance

Related documentation

• API Reference — read the audit log programmatically (audit:read scope).
• Service Level Objectives — track reliability targets on your monitors.
• Uptime Reports — generate and share uptime / SLA reports for any period.

Feedback or corrections: support@enori.io