Audit Log

The audit log keeps a record of all important actions in FT Configs UI, in time order. It helps administrators see who did what, when, and what changed.

When to use it

Use the audit log to:

  • review recent changes,

  • investigate the actions of one user,

  • track configuration imports,

  • check user management actions,

  • export a report for an audit.

Before you start

Only users with the ADMIN role can open the audit log. Users with the VIEWER or EDITOR role cannot see audit events.

  1. Click your avatar in the header and select Settings.

  2. Open the Audit log tab.

Expected result: the page shows the table of audit events.

What an event contains

Every data change becomes an audit event. This includes configuration changes, user operations, data imports, and security actions such as password changes and session revocations.

Each event contains:

  • who did the action (the username),

  • what the action affected (the entity type and the target),

  • when the action happened (the timestamp),

  • the operation of the user,

  • a readable description of the change.

Fields

The audit log shows events in a table with pages. The newest event is first.

Column Description

When

The date and time of the event in a relative format, for example "2 hours ago". Hover to see the exact date and time.

Operation

The type of action as a colored badge. The color shows the severity. See Operations and badge colors.

User

The username of the user who did the action.

Target

The affected object. The table shows a readable name (displayName) and not the technical identifier. For example, you see HTTPS (443) and not APP_PORTS#443. Hover to see the full identifier (entityType#entityId).
Click a row to open the event details.

Filter events

You can combine all filters. Click Reset filters to clear them.

Search

Enter a keyword in the search field. The field filters by entity ID, username, or type. The list updates while you type.

Entity type

Use the entity type list to show events for one type of object, for example USER or ACS_PARAMETER. The list groups the types by module:

Group Example entity types

ACS

ACS parameters, FCC configuration, external trace settings, and more.

Support/Management Portals

Angular module parameters: frames, tabs, network map, VoIP, and more.

Portals

Provision Portal objects and parameters, CSV settings, statuses, and more.

Northbound

Northbound API configuration.

Service API

Service API configuration.

User Management

Users and related operations.
The backend sends the group names and entity type labels in the language of the interface.

Username

Enter a username to see only the events of one administrator or operator.

Operations

Select one or more operations with the toggle badges. The table then shows only events with these operations. The backend sends the operation labels in the language of the interface.

Date range

Limit the results to a time period. You can use a preset or a custom range:

Preset Range

Today

From the start of the current day to now.

Yesterday

The full previous day.

Last 7 days

From the start of the day 6 days ago to now.

Last 30 days

From the start of the day 29 days ago to now.

This month

From the first day of the current month to now.

You can also enter a custom start date and end date.

Use the presets for routine reviews. To investigate an incident, set a custom range around the time of the event.

Save the filters in the URL

The page saves all active filters as URL parameters. This gives you three benefits:

  • The browser Back button returns to the list with the same filters.

  • You can share a filter link with colleagues. Copy the URL from the address bar.

  • You can bookmark a URL with your usual filters.

Example URL with filters:

/settings/audit-log?operation=DELETE&entityType=USER&from=2026-04-01T00:00:00&to=2026-04-15T23:59:59
The text search and the username in the URL update with a small delay (debounce). The delay stops many requests to the server while you type fast.

Export a CSV file

The Export CSV button is in the filter panel. It downloads the filtered events as a CSV file.

  • The file name is audit-log.csv.

  • The export uses the current filters: operations, entity type, username, and date range.

  • The backend limits the export to 100,000 rows.

If the filters match more than 100,000 events, the file contains only the first 100,000 events. Narrow the filters, for example with a shorter date range, to get all the data.
For routine reports, set the filters and click Export CSV. You can open the file in a spreadsheet editor such as Excel, Google Sheets, or LibreOffice Calc.

View event details

Click a row in the table. A page with the event details opens at /settings/audit-log/<eventId>.

Copy the event link

Each event has a unique URL. Click Copy link in the page header to copy it. You can send the link to a colleague, and it opens the same event. You can also save the link in a ticket for an incident or a task.

Use Copy link and not the address bar. It is faster, and the link is always correct.

Move between events

If you opened the event from a filtered list, the page header shows the Previous and Next buttons. They move to the previous and next event in the current selection.

  • The buttons appear only if the URL has the filter context.

  • The navigation keeps all filter parameters, so the Back button returns to the original list.

  • On the first event, the Previous button is disabled. On the last event, the Next button is disabled.

More fields

Field Description

Entity type

The type code of the affected object.

Entity ID

The internal identifier of the affected object. You can copy it to the clipboard.

Transaction ID

An optional identifier for a group of events.

Change reason

An optional reason from the user for the change.

Technical details

The Technical details section is collapsed by default. It shows more technical fields:

Field Description

IP address

The IP address of the computer of the user.

Request ID

The unique identifier of the HTTP request of the event.

User agent

The browser or client of the user.

Field changes

For an UPDATE event, the page shows a table of the changed fields:

Field Old value New value

The changed field

The value before the change

The value after the change

Use the table to see the changed fields and their old values.

Before and after snapshots

For an UPDATE event, the page can show the full state of the entity before and after the operation, side by side. For a CREATE event, the page shows a snapshot of the created entity. For a DELETE event, the page shows a snapshot of the deleted entity.

Operations and badge colors

Each event has an operation type with a colored badge. Two rules decide the color:

  1. A known operation has a fixed color. See the table below.

  2. A new or unknown operation gets the color of the severity level (severity) from the backend:

    • LOW: gray,

    • MEDIUM: amber,

    • HIGH: orange,

    • a destructive operation (destructive: true): red.

The backend sends the operation labels in the language of the interface. If the backend adds a new operation, the operation gets the correct color from its severity level.

Known operations

Operation Badge color Description

CREATE

Green

The system created a new entity.

UPDATE

Blue

A user changed an existing entity.

DELETE

Red

A user deleted an entity permanently.

IMPORT

Amber

A user imported data from a file.

READ

Light blue

The system recorded a read to track access to sensitive data.

PASSWORD_CHANGE

Purple

A user changed a password.

SESSION_REVOKE

Orange

An administrator revoked the sessions of a user.

ROLE_CHANGE

Purple

An administrator changed the role of a user.

USER_SUSPEND

Red

An administrator suspended a user account.

USER_ACTIVATE

Green

An administrator activated a suspended user account.

OTHER

Gray

An action outside the other categories.
To investigate an incident, filter by the operation type first. For example, select the DELETE operation to find all deletions in a time period.

Use keyboard shortcuts

Key Action

Esc

Returns from the event details to the list. The filters stay.

Left arrow

Opens the previous event on the details page. It works only if the URL has the filter context.

Right arrow

Opens the next event on the details page. It works only if the URL has the filter context.
The arrow keys work only on the details page. They work only if you opened the page from a filtered list.

Review recent changes

  1. Open the audit log.

  2. Click the Today or Last 7 days preset.

  3. Review the event list.

Investigate the actions of one user

  1. Open the audit log.

  2. Enter the username in the username filter.

  3. Set a date range, if you need it.

  4. Click a row to see the details.

  5. Click Previous and Next, or press the left and right arrow keys, to move through the events of the user.

Copy the URL with the filters and save it in a ticket. Colleagues then see the same events.

Track configuration imports

  1. Open the audit log.

  2. Select the IMPORT operation.

  3. Set the date range.

  4. Click an import event to see the details of the change.

Check user management actions

  1. Open the audit log.

  2. Select the operations: CREATE, ROLE_CHANGE, USER_SUSPEND, USER_ACTIVATE, or DELETE.

  3. If you need it, select the USER entity type in the User Management group.

  4. Review the actions in time order.

Export a report for an audit

  1. Open the audit log.

  2. Set the filters: operations, period, and user.

  3. Click Export CSV.

  4. Open the downloaded audit-log.csv file in a spreadsheet editor.

Share an event link

  1. Open the audit log and find the event.

  2. Click the row to open the details.

  3. Click Copy link in the page header.

  4. Send the link to a colleague.

Expected result: the link opens the same event.

Audit log records are immutable. You cannot edit or delete them. This gives you a reliable record for compliance and troubleshooting.

Troubleshooting

The Previous and Next buttons do not appear on the details page

You opened the event with a direct link and not from a filtered list. The buttons appear only if the URL has the filter context. Click Back to audit log or press Esc. Set the filters. Click an event in the list.

The CSV file does not contain all expected events

The backend limits the export to 100,000 rows. If the current filters match more events, the file is incomplete. Narrow the filters, for example with a shorter date range or one entity type. Then export again.

The filters are reset when you return from the details page

The page does not support your way back. Use the Back to audit log button, the Esc key, or the browser Back button. The page saves the filters in the URL and restores them when you return.

The entity type list does not show your type

The UI loads the list from the backend. If the backend is not available or a loading error occurs, the list can be empty. Click the refresh icon in the filter panel. If the problem stays, check the connection to the backend.

Related pages