Audit log
See who changed what and when, with before and after values, kept for 24 months.
Audit log
A record of who changed what in your organisation, when, and what the values were before and after.
- Every change to settings and configuration is recorded with the person, the time and the before and after values.
- Only Owners and Admins can read it. Members see an "Owners and admins only" message.
- Events are kept for 24 months, then deleted automatically.
- Secrets such as webhook URLs, keys and passwords are never stored; they show as [redacted].
- It records changes, not views: reading a page is not logged. Some areas are not covered yet (see below).
- You are an Owner or Admin. Impersonation sessions (support "open as organisation") cannot open it.
Find an event
| Filter | What it does |
|---|---|
| Event type | Create, Update, Delete or Other. |
| Object type | The kind of thing changed, for example user, budget, saved view, virtual tag. Only types that appear in your log are listed. |
| Object name | Search by the name of the thing changed. |
| User | Who made the change. |
| Source | Console (the web app), Api, System (automatic jobs) or Operator (CostGlass support). |
| From | Start date. With To, sets the period (UTC days). |
Read the list and an event
The table columns are When, Event, Object type, Object, User and Source. The coloured badge shows create, update, delete or other. Use the pager at the bottom for more rows.
The event panel shows the time, action, object and ID, user and source, then a Changes table with Field, Previous and New. Red marks what was removed or replaced, green what is new. Copy link gives a link to that event for colleagues who are Owners or Admins.
Export
Click Export CSV to download the events that match your filters: time (UTC), event type, action, object, user, email, source and which fields changed. An export holds at most the newest 50,000 events and tells you if it was cut short.
What is recorded
- People: invitations, role changes, removals, and who is scoped to which hierarchy node.
- Hierarchy: nodes and rules created, renamed, moved or deleted, and account placements.
- Cloud and SaaS connections: created, updated, disconnected; Kubernetes agent tokens and cluster removal.
- Single sign-on changes, Jira connect and disconnect, and the data residency settings and purges.
- Budgets, cost alerts, anomaly rules and settings, uptime alert policies, unit economics metrics.
- Virtual tags and their rules, saved views, saved filters, saved reports, report and view schedules, dashboards, issues and annotations.
What is not recorded
- Creating and revoking API keys, billing and plan changes, notification preferences and profile edits.
- Some actions where the person is not identified are recorded without a user (for example Azure consent steps, and routes that take the organisation from the request).
- An in-cluster Kubernetes agent registering itself, and creating or deleting an uptime service.
- Anything done before an area started being logged.
- Sign-ins and page views.
Retention
Events are kept for 24 months (730 days). A daily job removes older ones and also whenever you use Purge Now on the data residency page. Each deletion writes its own entry saying how many rows went.