Audit Log

The Audit Log tracks user actions performed on platform entities — devices, assets, dashboards, rule chains, customers, users, and more. Each record captures who performed the action, what was changed, when it happened, and whether it succeeded. Tenant administrators rely on the audit log to monitor activity, investigate incidents, and support security and compliance reviews.

Open Security ⇾ Audit logs from the left-hand menu. The page lists recorded actions for the tenant, sorted by time with the most recent first.

Use the controls above the table to narrow down the list:

• Time range — click the time range button (for example, last 1 day) to choose a preset period or a custom date range.
• Audit log filter — filter the list by criteria such as entity type, user, action type, or status.
• Search — click the search icon to reveal a text field and filter the currently loaded records by any visible text, such as an entity name or user email.
• Refresh — reload the list using the current time range and filters.

Open the ⋮ menu at the end of a row and select Details to inspect the full record. The Audit log details dialog shows the raw Action data — the JSON payload associated with the action, such as the resulting entity state after a create or update, or error details when an action fails.

This is useful for confirming exactly what changed, for example comparing a device’s configuration before and after an update, or checking which fields were set when an entity was created.

Each row summarizes one recorded action:

Audit logs are also accessible programmatically via the REST API. Available endpoints support fetching entries by user, entity, or customer, or retrieving all records with pagination.

Refer to the REST API reference for the full list of audit log endpoints.

System administrators configure audit logging in `thingsboard.yml`. The configuration controls whether logging is enabled, how data is partitioned for storage, which entity types are logged, and at what level.

# Audit log parameters
audit_log:
  # Enable/disable audit log functionality.
  enabled: "${AUDIT_LOG_ENABLED:true}"
  # Specify partitioning size for audit log by tenant id storage. Example MINUTES, HOURS, DAYS, MONTHS
  by_tenant_partitioning: "${AUDIT_LOG_BY_TENANT_PARTITIONING:MONTHS}"
  # Number of days as history period if startTime and endTime are not specified
  default_query_period: "${AUDIT_LOG_DEFAULT_QUERY_PERIOD:30}"
  # Logging levels per each entity type.
  # Allowed values: OFF (disable), W (log write operations), RW (log read and write operations)
  logging_level:
    mask:
      "device": "${AUDIT_LOG_MASK_DEVICE:W}"
      "asset": "${AUDIT_LOG_MASK_ASSET:W}"
      "dashboard": "${AUDIT_LOG_MASK_DASHBOARD:OFF}"
      "customer": "${AUDIT_LOG_MASK_CUSTOMER:W}"
      "user": "${AUDIT_LOG_MASK_USER:RW}"
      "rule": "${AUDIT_LOG_MASK_RULE:RW}"
      "plugin": "${AUDIT_LOG_MASK_PLUGIN:RW}"
  sink:
    # Type of external sink. possible options: none, elasticsearch
    type: "${AUDIT_LOG_SINK_TYPE:none}"
    # Name of the index where audit logs stored
    # Index name could contain next placeholders (not mandatory):
    # @{TENANT} - substituted by tenant ID
    # @{DATE} - substituted by current date in format provided in audit_log.sink.date_format
    index_pattern: "${AUDIT_LOG_SINK_INDEX_PATTERN:@{TENANT}_AUDIT_LOG_@{DATE}}"
    # Date format. Details of the pattern could be found here:
    # https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html
    date_format: "${AUDIT_LOG_SINK_DATE_FORMAT:YYYY.MM.DD}"
    scheme_name: "${AUDIT_LOG_SINK_SCHEME_NAME:http}" # http or https
    host: "${AUDIT_LOG_SINK_HOST:localhost}"
    port: "${AUDIT_LOG_SINK_POST:9200}"
    user_name: "${AUDIT_LOG_SINK_USER_NAME:}"
    password: "${AUDIT_LOG_SINK_PASSWORD:}"

The logging_level.mask section controls which entity types are logged and at what level:

Default configuration logs write operations for devices, assets, and customers; disables logging for dashboards; and logs read and write operations for users, rules, and plugins.

• Security Overview — authentication, sessions, and other tenant-wide security settings.
• Roles and Permissions — control who can view audit records for specific entities, customers, or users.
• Users — user accounts are themselves an audited entity type.
• Devices — view a device’s own audit log from its details page.
• Assets — view an asset’s own audit log from its details page.
• Customers — view a customer’s own audit log from its details page.