Audit Logs
An audit log records who did what, when and from where. There are two of them:
| Log | Records | Who can see it |
|---|---|---|
| Workspace “Audit Log” | Actions in the workspace, such as instance power, firewall changes, member invites and API token creation | Every member of the workspace |
| Account “Security Activity” | Sign-ins and security changes on your account, such as failed sign-ins, password changes and two-factor changes | Only you |
Actions you take inside a workspace show in that workspace’s log, not in your Security Activity. Entries cannot be deleted or exported and we retain these logs for compliance.
Workspace audit logs
Section titled “Workspace audit logs”- Head over to your workspace’s “Audit Log” page
Each instance also has a “Logs” tab with only that instance’s entries.
Account security activity
Section titled “Account security activity”- Head over to https://dash.galaxygate.net/account/activity
Check it if you get a login email you do not recognize. Read more in Login.
Reading an entry
Section titled “Reading an entry”The newest entries come first, 50 per page.
| Column | Shows |
|---|---|
| Time | When it happened. Hover for the full date |
| Action | What happened, such as “Instance powered off” or “Password sign-in failed” |
| Resource | What it happened to, with a link to it |
| Actor | Who did it (a user, an API token, an application or the system). Staff actions show a “Staff” tag |
| Source | The IP address and its country |
Click an entry to expand it:
| Section | Shows |
|---|---|
| Changes | Each changed field with its value before and after |
| Details | Extra facts for that action, such as the second factor used or a token’s scopes |
| Actor | The actor’s name, type and ID |
| Source | The IP address, network, network type (such as “Proxy or VPN”) and country |
| Entry | The time, the resource it is filed under and the workflow that ran |
Hit “Copy link” on an expanded entry to share a link to it.
Filtering
Section titled “Filtering”- Head over to the log you want to filter
- Hit “Filters”
- Fill in the fields you need
- Hit “Apply”
You can filter by action, resource, actor, date range, IP address or range (such
as 203.0.113.0/24), two-letter country code, ASN, network type and workflow. The filters stay in the page URL. Bookmark the URL to keep a filtered view.
On an expanded entry, “Same actor”, “Same resource”, “Same IP” and “Same workflow” filter the log by that entry’s value in one click.