System Logs Module
Reading the Audit Trail
A read-only record of real events that already happened elsewhere in the app — sign-ins, role changes, settings updates, imports, and more — written automatically, never typed in by hand.
Start here
Before you start
There’s nothing to configure. Entries appear here the moment a real action happens somewhere else — a sign-in, a role change, a settings save, an import commit, a Super Admin grant. There is deliberately no “create log entry” button anywhere in the app: a hand-authored audit trail isn’t trustworthy as one.
Most entries belong to whichever company was active when the action happened, and only show up while that company is active. A handful of genuinely global events — sign-ins, failed sign-in attempts, company deletion, Super Admin grants, viewing-as-another-user, and password resets — aren’t tied to any one company, so they show up regardless of which company you have active.
What’s in here
Reading the log
Each row shows a Level, a Source (which module logged it — auth, users, settings, import-export, and others), a plain-language message, who did it (actor), and when. Newest entries are always first.
Individual rows can be removed by an Administrator if genuinely needed — there’s a confirmation prompt first, and no undo after that.
Filtering & searching
Use the search box to match against the message text, or the Level and Source dropdowns to narrow the list. The Source list is built from whatever sources actually appear in your data — it isn’t a fixed menu, so a module that’s never logged anything for this company won’t show up as an option yet.
The KPI cards
| Card | What it’s measuring |
|---|---|
| Total Events | Count for this view, with a 30-day trend line and %-change against the prior 30 days. |
| Errors / Warnings | Raw counts at each level, all-time. |
| System Health | 100% minus the share of all events flagged Error or Warning — a real ratio computed from your own log rows, not a fabricated score. |
| Most Active Actor | Whoever’s name appears on the most logged events. |
Common tasks
Investigating a failed sign-in
Someone says they couldn’t log in, or you want to check for repeated failed attempts.
Filter Source to “auth”
Sign-in and failed-sign-in events both log under this source, regardless of which company is active.
Search the username
The message includes the exact username or login that was attempted.
Check the timestamps
A cluster of failed attempts close together is worth following up on directly with that person.
Auditing a role or access change
Filter Source to users to see every role change, user addition/removal, Super Admin grant, password reset, and view-as session in one place — each logged the moment it happened in Users & Roles, with the actor’s name in the message.
Reference
Log levels
| Level | Typical meaning |
|---|---|
| Info | A routine, expected event — a sign-in, a settings save. |
| Success | Something completed the way it should — a user added, an import committed. |
| Warning | Worth a second look — a role change, a failed sign-in, an account deletion. |
| Error | Something genuinely went wrong. |
What this module doesn’t do
Only the modules that explicitly call the logger produce entries — this is a curated audit trail of significant events (sign-ins, access changes, settings saves, imports), not a full field-by-field history of every record edit across the app.
Entries are kept indefinitely by default — there’s no automatic expiry, and no built-in CSV/PDF export for compliance archiving.
Deleting a company permanently deletes its log history along with it — there’s no separate retention for audit records once the company itself is gone.