Skip to content
Copyright © 2022-2026 basebox GmbH, all rights reserved.
Licensed to be used in conjunction with basebox, only.

// admin

Audit Log

Brief description

The audit log completely logs security-relevant actions in your organization – from logins to changes to users and groups, and the creation of daily announcements. Each entry records who did what and when, and whether it succeeded.

What is the audit log used for

The audit log is your tool for traceability, security, and compliance. With it you can:

  • trace processes completely (e.g., "Who deleted this group?")
  • detect failed or suspicious actions
  • export evidence for internal or external audits as CSV

Where to find the audit log

Open Administration → Audit Log in the sidebar. This area is accessible only to administrators.

Audit log – overview

Each entry in the table has the following columns:

Column Meaning
Timestamp Date and time of the action, precise to the millisecond
User Identifier of the user who triggered the action
Action The action performed (see "Understanding actions" below)
Resource type Type of the affected object, e.g. user, group, message_of_day, app, audit
Resource ID Identifier of the specific affected object
Result SUCCESS or FAILURE
Details Additional technical information about the action, if available

Understanding actions

Action names follow a fixed pattern of source and operation:

  • user.login – A user logged in
  • graphql:createGroup / graphql:deleteGroup – Group created or deleted
  • graphql:addUserToGroup / graphql:removeUserFromGroup – User added to or removed from a group
  • graphql:editUser – User edited
  • graphql:createMessageOfDay / updateMessageOfDay / dismissMessageOfDay – Daily announcement created, changed, or dismissed
  • rest:exportAuditLogs – Audit log exported as CSV

This lets you see at a glance what kind of process was logged.

Step by step

Filtering entries:

  1. Narrow down the time range using From date and To date.
  2. Optional: Enter one or more actions under Action as a comma-separated list (most reliably using the exact action names from the "Action" column, e.g. graphql:deleteGroup).
  3. Optional: Restrict to an object type using Resource type (e.g. group).
  4. Use Result to filter specifically for SUCCESS or FAILURE.
  5. Click Apply filter to update the list. Reset discards all filters.

Audit log – control bar

Exporting as CSV:

  1. Set the desired filters first (the export follows the current view).
  2. Click CSV export at the top right.
  3. The file is saved locally on your device and can be further analyzed, e.g. in Excel.

Notes

Note

  • Changes to the filters only take effect after clicking Apply filter.
  • The Action field expects the technical action names; you'll get the most accurate results by copying a value from the "Action" column exactly.
  • Use Result = FAILURE to find failed operations specifically.

Frequently asked questions

What is logged? Security-relevant actions such as logins, as well as changes to users, groups, daily announcements, and other resources – each with a timestamp, the triggering user, the result, and the affected resource.

How do I find only failed actions? Set the Result filter to FAILURE and click Apply filter.

Can I process the entries further? Yes, use CSV export to download the currently filtered entries as a CSV file; it is saved locally.

Why doesn't the list change when I enter a filter? Filters only take effect after clicking Apply filter.