> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shiftlabs.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Track all activity and changes in your organization

Audit logs record all actions performed in your organization. Use them to track changes, investigate issues, and meet compliance requirements.

## Audit Log Types

ShiftLabs provides two audit log views:

* **System Audit Logs**: All API operations (cluster changes, pipeline runs, deployments, etc.)
* **IAM Audit Logs**: Identity and access management activities (user invites, role assignments, permission checks)

## How to View Audit Logs

**System Audit Logs:**
Go to **Audit & Compliance → Audit Logs**

**IAM Audit Logs:**
Go to **Audit & Compliance → IAM Audit Logs**

## How to Filter Audit Logs

Use the filter panel to narrow down results:

* **Search**: Filter by user email or endpoint
* **Project**: Filter by specific project (System Audit only)
* **Status**: Show only successful or failed operations
* **Date Range**: Specify start and end dates
* **User Email**: Filter by specific user
* **Action**: Filter by action type (e.g., CREATE, DELETE, LOGIN)

<Tip>
  Click the filter icon to expand advanced filters. Click any row to see full details.
</Tip>

## How to View Log Details

Click on any log entry to expand and see:

* Full timestamp
* User information
* IP address and user agent
* Request details (HTTP method, endpoint)
* Duration
* Error message (if failed)

## Common Actions

**System Audit Actions:**

* `CREATE`, `READ`, `UPDATE`, `DELETE` - CRUD operations
* `LOGIN`, `LOGOUT`, `LOGIN_FAILED` - Authentication events
* `CLUSTER_CREATE`, `CLUSTER_DELETE` - Cluster operations
* `PIPELINE_RUN`, `DEPLOY`, `ROLLBACK` - CI/CD operations
* `SECRET_CREATE`, `SECRET_READ` - Vault operations

**IAM Audit Actions:**

* `user_invited`, `user_removed` - User management
* `role_assigned`, `role_revoked` - Role changes
* `group_member_added`, `group_member_removed` - Group changes
* `permission_check` - Permission verifications

## Troubleshooting

<AccordionGroup>
  <Accordion title="Cannot find a specific action">
    1. Check the date range - logs may be outside your filter
    2. Try the search field with user email or endpoint
    3. Clear all filters and browse chronologically
  </Accordion>

  <Accordion title="Audit logs not appearing">
    * Verify you have permission to view audit logs
    * Check if you're filtering by the correct project
    * Some internal system operations may not be logged
  </Accordion>

  <Accordion title="Need logs older than displayed">
    Audit logs are retained based on your plan. Contact support for extended retention or log exports.
  </Accordion>
</AccordionGroup>

## FAQ

<AccordionGroup>
  <Accordion title="How long are audit logs retained?">
    Retention period depends on your plan. Contact support for specific details or extended retention.
  </Accordion>

  <Accordion title="Can I export audit logs?">
    Export functionality may be available depending on your plan. Contact support for bulk exports.
  </Accordion>

  <Accordion title="Are failed login attempts logged?">
    Yes. Failed logins appear with `LOGIN_FAILED` action and status "Failed".
  </Accordion>

  <Accordion title="What's the difference between System and IAM audit logs?">
    System logs track all API operations. IAM logs specifically track identity and access changes (users, roles, groups, permissions).
  </Accordion>

  <Accordion title="Can I see who changed a user's roles?">
    Yes. Check IAM Audit Logs and filter by action `role_assigned` or search for the user's email.
  </Accordion>
</AccordionGroup>