Management Console audit log

Overview

Management Console keeps records of users' activity in the audit.log file, located in the Management Console's storage folder and makes it possible to monitor users that login or logout and make changes to Resilio configuration.

By default, the audit log is archived when it reaches 104 MB. rotates when the file reaches 104 MB, it's zipped up. Console keeps 10 of such zip files. Rotation settings can be changed in Management Console's configuration file in the loggers section.

Audit log format

Note

Only the action and the timestamp fields are present in all events.
Presence of other fields depends on the event itself.

{  
    "action": "action performed by a user or agent",  
    "timestamp": "timestamp of event in unix format in milliseconds",  
    "source": {"Information about source machine of the action, IP address, device and browser Agent of a user who performed an action, when user tries to login or Agent tries to connect"},  
    "initiator": {"by model - a user or an object who initiated the action"},  
    "target": {"by model - object that is changed/created by action"},  
    "parameters": {"different actions for different object types have their own set of parameters"},  
    "changes": {  
        "to": {"new object's settings"},  
        "from": {"previous object's settings. For new objects this field is empty."}  
    }  
}

Audit log parameters

_type indicates the object model from which (if initiator) or on which (if target) an action was performed:

Management Console’s user:InternalUserModel
Agent: ClientModel
Management Console’s user group:UserGroupModel
Domain Service User:DSUserModel
Domain Service user group:DSGroupModel
Management Console. Is source when a new Agent connects or at failed Agent connect attempt:Server
Is source when job run is started or stopped by schedule:Schedule
Reset password, create new user or restore from a backup via srvctrl command line utility:SRVCTRL
By API token:API
Agent connected to Management Console, awaiting administrator's approval:PendingAgentModel

Note

Additionally, the following types are the models of newly created objects: ActiveDirectoryConfigModel, AgentProfileModel, ApiTokenModel, BackupJobModel (consolidation job), BackupModel, BootstrapTokenModel, GroupModel, JobProfileModel, MailerTransporterModel, LicenseModel, ScheduleModel, ScriptJobModel, ServerProfileModel, SyncJobModel, SupportRequestModel, TagModel, TransferJobModel (distribution job), JobSubscriptionModel, EmailUserNotificationDestinationModel, EmailNotificationDestinationModel, WebHookNotificationDestinationModel,WebHookModel, IgnoredErrorModel, AbortTransferErrorModel.

Available actions

Action	Description
`create` `delete` `update`	Object (`target`) was created, updated or deleted. If a new Agent connects to Management Console or shows up a list of approval this counts as `create` action. When an admin approves or declines new Agents, new event with action `update` on ClientModel appears. If the action is performed with a cloud storage, the storage's name are recorded as `target` and storage parameters as `changes`.
`start` `stop`	Management Console process starts or stops. When restoring from a backup, these two events appear automatically, since restoring backup is accompanied with Management Console restart. In v4.1.0 the entry includes Management Console version. Synchronization Job or Job Run was started or stopped.
`sign up` `login` `logout` `failed login attempt` `incorrect password` `block`	User actions when accessing Management Console UI. Action `failed login attempt` means the user has entered an invalid username. After 10 failed login attempts, the user is blocked and the `block` event is registered.
`generate reset password token` `reset password` `change password` (in v6.0)	`generate reset password token` action means that super admin generated reset password token for blocked user via Management Console UI or generated reset password link for user via `srvctrl`. `reset password` action is registered when the password is reset from Management Console UI via reset password link. `change password` action is registered when the password was changed from the Management Console UI.
`restore backup`	Management Console is restored from a backup by a via Management Console UI or `srvctrl` command line utility. This event is followed by Management Console restart with corresponding `stop` and `start` events.
`invalid api token`	Action of an API request with an invalid token.
`failed agent connect attempt` In v6.0: `agent connection opened` `agent connected` `agent connection declined` `agent connection pending` `agent authentication failed` `agent connection error` `agent connection lifetime expired` `agent connection closed` `agent reauthentication requested`	Agent connection to Management Console. The `failed agent connect attempt` event is caused by an invalid bootstrap token.
`failed custom OIDC configuration` `failed Okta configuration`	Incorrect OpenID or Okta configuration in Management Console.
`rename agent`	The Agent has been renamed by admin from Management Console UI.
`restart agent attempt`	The Agent was restarted from Management Console UI. The Management Console can only send shutdown signal and does not control the startup of the Agent, hence the the action says `attempt`.
`stop initial synchronization`	Initial synchronization with Reference Agent was manually stopped by a user.