Audit Logs
The audit log is a tamper-evident record of activity, data access, and AI runs in a workspace. Only owners and admins can view it.
To open it, go to the Security tab in the workspace settings and click Open audit log in the Audit log section. That section also controls what is recorded and how long records are kept. See Workspace security.
Three record types
Switch between the three types at the top of the page:
- Activity: actions people take in the workspace, such as inviting and removing members, changing settings, and creating, editing, or deleting dashboards, reports, scheduled tasks, and data connections.
- Data access: reads of sensitive resources, such as report downloads and views, document downloads, views of publicly shared dashboards, widget data and query runs, and reads and exports of the audit log itself.
- AI runs: each run of the Assistant and other AI features, such as chat, dashboard generation, reports, Slack, the embedded agent, and scheduled tasks.
Read a record
Each row shows the action, the person, the resource affected, the time, and the request ID. Click a row to open Record details, which shows:
- Time, Person, Action, Resource, and Status.
- IP address and Device.
- Request ID, which you can share with support to trace a request.
- Sequence, Record hash, and Previous hash, which link the record to the one before it.
- Details, with any extra data recorded for the action.
An AI run shows the Request and Answer, the Model, the person's Access at run time, the SQL statements run, the Tool calls, token Usage, the Duration, and the Data sources used.
Filter records
- Search by name or email to see one person's records.
- Action to show only records with that exact action name, such as
workspace.member.remove. This filter is not available for AI runs. - Request ID to find the records for one request.
- From and To to set a date range.
Click Clear filters to start again. The page shows up to the newest 10,000 matching records, so narrow the dates to reach older ones.
Export records
Click Export and choose Download CSV or Download JSON Lines. The export uses the record type and filters you have selected.
Check that records have not been changed
Each record stores a hash of its content and the hash of the record before it. Click Verify integrity to check the chain. Qubit reports how many records it checked, or where the chain fails, for example because a record was changed or records are missing.
How long records are kept
Records are kept for the retention period set in the Security tab, from 30 to 2,555 days. A daily cleanup deletes older records.