Audit Log

The audit log keeps a chronological record of all significant actions performed in FT Configs UI. It lets administrators review who did what, when, and exactly what changed.

Prerequisites

The audit log is available only to users with the ADMIN role. Users with the VIEWER or EDITOR roles cannot view audit events.

To open the audit log, go to Settings > Audit Log in the sidebar.

Overview

Every action that changes data in the system is recorded as an audit event. This includes configuration changes, user operations, data imports, and security-related actions — password changes, session revocations, and others.

Each event captures:

  • who performed the action (username),

  • what was affected (entity type and target),

  • when it happened (timestamp),

  • which operation was performed,

  • a human-readable description of the change.

Viewing the Event List

The audit log shows events in a paginated table, sorted by time — newest to oldest.

Each row in the list contains the following columns:

Column Description

When

The date and time when the event occurred. Shown in relative format (for example, "2 hours ago"). Hovering shows the exact date and time.

Operation

The type of action performed, shown as a colored badge. The color is determined by the operation’s severity level (see Operations and Color Badges).

User

The username of the user who performed the action. The actor’s username field is shown.

Target

The affected object. A human-readable name (displayName) is shown instead of the technical identifier. For example, HTTPS (443) instead of APP_PORTS#443. Hovering shows the full technical identifier (entityType#entityId).
Click a row to open the event detail page.

Filtering Events

The audit log provides several filters to find the events you need. All filters can be combined.

Text Search

Enter a keyword in the search field to filter events by description text (context). Results update as you type.

Entity Type Filter

Use the entity-type dropdown to show only events related to a specific object type (for example, USER, ACS_PARAMETER).

Entity types are grouped by module for easier navigation:

Group Example entity types

ACS

ACS parameters, FCC configuration, external trace settings, and others.

Support/Management Portals

Angular module parameters: frames, tabs, network map, VoIP, and others.

Portals

Provision Portal objects and parameters, CSV settings, statuses, and others.

Northbound

Northbound API configuration.

Service API

Service API configuration.

User Management

Users and related operations.
Group names and entity-type labels are returned localized from the backend — they are shown in the current interface language.

Username Filter

Enter a username to see only events performed by a specific administrator or operator.

Operations Filter

Select one or more operations using the toggle badges. Only events matching the selected operations are shown.

Operation labels are returned localized from the backend.

Date Range Filter

Limit results to a specific time period. The filter supports both quick presets and a custom range:

Preset Range

Today

From the start of the current day to now.

Yesterday

The full previous day.

Last 7 days

From 7 days ago to now.

Last 30 days

From 30 days ago to now.

This month

From the first day of the current month to now.

You can also specify a custom start and end date for more precise filtering.

Use date presets for routine reviews. To investigate an incident, set a custom range around the event time.

Saving Filters in the URL

All active filters are automatically saved as URL parameters of the page. This means:

  • The browser’s Back button — returns to the list with the same filters that were set.

  • Filter links can be shared with colleagues — just copy the URL from the address bar.

  • Bookmarks — you can bookmark a URL with a frequently used filter set.

Example URL with filters:

/settings/audit-log?operation=DELETE&entityType=USER&from=2026-04-01T00:00:00&to=2026-04-15T23:59:59
The text search and username in the URL update with a small delay (debounce) to avoid overloading the server with requests during fast typing.

CSV Export

The Export CSV button in the filter panel lets you download the filtered events in CSV format.

  • The file is downloaded as audit-log.csv.

  • The export honors the current filters (operations, entity type, username, date range).

  • The backend limits the export to 100,000 rows.

If the filtered dataset exceeds 100,000 records, the file will contain only the first 100,000. Narrow the filters (for example, specify a shorter date range) to obtain all the data you need.
For routine reports, set the filters you need, then click Export CSV — the file can be opened in any spreadsheet editor (Excel, Google Sheets, LibreOffice Calc).

Viewing Event Details

Click any row in the table to open a dedicated event detail page. The page opens at /settings/audit-log/<eventId>.

Event Link (deep-link)

Each event has a unique URL that you can:

  • copy — click the Copy link button in the detail page header,

  • send to a colleague — the link opens this exact event,

  • save in a ticket — to link it to an incident or task.

Use the Copy link button instead of copying the URL from the address bar — it is faster, and the link is always correct.

Prev/Next Navigation

If you opened an event from a filtered list, Prev and Next buttons appear in the page header to move to the previous and next event within the current selection.

  • The buttons are available only when filter context is present in the URL.

  • Navigation preserves all filter parameters, so the Back button returns you to the original list.

  • If the current event is the first in the list, the Prev button is disabled; likewise for the last and Next.

Additional Fields in Details

Field Description

Entity Type

The type code of the affected object.

Entity ID

The internal identifier of the affected object. Supports copying to the clipboard.

Transaction ID

An optional correlation identifier linking several events.

Change Reason

An optional reason supplied by the user when making the change.

Technical Details

Additional technical fields are hidden by default in a collapsible Technical details section:

Field Description

IP Address

The IP address from which the action was performed.

Request ID

The unique identifier of the HTTP request that triggered the event.

User Agent

The browser or client used to perform the action.

Field-Level Changes

When an entity is updated (UPDATE), the detail page shows a table of changed fields:

Field path Old value New value

The specific field that changed

Value before the change

Value after the change

This lets you see exactly which fields were changed and what their previous values were.

Before/After Snapshots

For UPDATE operations, the detail page may contain full snapshots of the entity state before and after the operation, shown side by side.

For CREATE operations, a snapshot of the created entity is shown; for DELETE, a snapshot of the deleted entity.

Operations and Color Badges

Each audit event has an operation type, shown as a colored badge. The badge color is determined by two rules:

  1. For known operations — a fixed semantic color (see the table below).

  2. For new/unknown operations — the color is determined by the severity level (severity) supplied by the backend:

    • LOW — gray (neutral),

    • MEDIUM — amber,

    • HIGH — orange,

    • destructive operations (destructive: true) — red.

Operation labels are returned localized from the backend. If the backend adds a new operation, it automatically gets the correct color based on its severity level.

Known Operations

Operation Badge color Description

CREATE

Green

A new entity was created.

UPDATE

Blue

An existing entity was modified.

DELETE

Red

An entity was permanently deleted.

IMPORT

Amber

Data was imported from a file.

READ

Light blue

A read was recorded (for tracking access to sensitive data).

PASSWORD_CHANGE

Purple

A user’s password was changed.

SESSION_REVOKE

Orange

A user’s sessions were revoked.

ROLE_CHANGE

Purple

A user’s role was changed.

USER_SUSPEND

Red

A user account was suspended.

USER_ACTIVATE

Green

A suspended user account was activated.

OTHER

Gray

An action that does not fall into the listed categories.
When investigating an incident, first filter by the relevant operation type. For example, use the DELETE filter to find all deletions within a specific period.

Keyboard Shortcuts

The audit log supports keyboard navigation:

Key Action

Esc

Return from the event detail page to the list. Filters are preserved.

← (left arrow)

Go to the previous event (on the detail page). Available only when filter context is present.

→ (right arrow)

Go to the next event (on the detail page). Available only when filter context is present.
Arrow navigation works only on the event detail page and only if you opened it from a filtered list.

Common Use Cases

Reviewing Recent Changes

  1. Open the audit log.

  2. Use the Today or Last 7 days preset.

  3. Review the event list.

Investigating a Specific User’s Actions

  1. Open the audit log.

  2. Enter the username in the filter.

  3. Set a date range if needed.

  4. Click a row to view the details.

  5. Use the Prev/Next buttons or the ← / → keys to step through that user’s events.

Copy the URL with filters and save it in a ticket — colleagues can see the same set of events.

Tracking Configuration Imports

  1. Open the audit log.

  2. Select the IMPORT operation in the operations filter.

  3. Set the date range you need.

  4. Click an import event to see the change details.

Auditing User Management Actions

  1. Open the audit log.

  2. Select the operations you need: CREATE, ROLE_CHANGE, USER_SUSPEND, USER_ACTIVATE, or DELETE.

  3. If needed, filter by the USER entity type (in the User Management group).

  4. Review the timeline of actions.

Exporting a Report for an Audit

  1. Open the audit log.

  2. Configure the filters you need (operations, period, user).

  3. Click the Export CSV button.

  4. Open the downloaded audit-log.csv file in a spreadsheet editor.

Sharing an Event Link with a Colleague

  1. Open the audit log and find the event you need.

  2. Click the row to open the details.

  3. Click the Copy link button in the page header.

  4. Send the copied link to a colleague — it opens this exact event.

Audit log records are immutable. They cannot be edited or deleted — this ensures a reliable record for compliance and troubleshooting purposes.

Troubleshooting

Symptom: the Prev/Next buttons do not appear on the detail page

Cause: You opened the event via a direct link rather than from a filtered list. The navigation buttons appear only when filter context is present in the URL. Solution: Return to the event list (the "Back to list" button or the Esc key), apply the filters you need, and click an event from the list.

Symptom: the CSV file does not contain all the expected records

Cause: The backend limits the export to 100,000 rows. If the number of events under the current filters exceeds this limit, the file will be incomplete. Solution: Narrow the filters — for example, specify a shorter date range or a specific entity type — and export again.

Symptom: filters are reset when returning from the detail page

Cause: An unsupported mechanism was used to return. The intended path is the "Back to list" button, the Esc key, or the browser’s Back button. Solution: Use the Back to list button on the event detail page or the Esc key. Filters are saved in the URL and restored on return.

Symptom: the entity-type filter does not list the type you need

Cause: The entity-type list is loaded from the backend. If the backend is unavailable or a loading error occurred, the list may be empty. Solution: Click the refresh button (the ↻ icon) in the filter panel. If the problem persists, check that the backend is reachable.