# Audit Log

> A searchable record of who changed what, and when.

Source: https://joinnasnet.com/en/guides/nasnet-linux/audit-log/
Last updated: 2026-08-14

---

## Overview

Every administrative action is written to the **Audit Log**: settings changes,
subscription edits, server and Xray operations, backups and restores. It is the
record you reach for when something changed and nobody remembers changing it,
and the one place that ties an action to an actor and a timestamp.

## Before you start

- How long entries survive is set by `retention_audit_logs_days` under
  **Settings → Data Retention**. Set it to `0` to keep entries forever.
- The Telegram bot can also surface the audit log through an admin command.

## Steps

1. Open **Audit Log** from the sidebar.
2. Check **Total Events** at the top for the size of the record.
3. Narrow by **Entity Type**, a dropdown that starts at **All entities**.
4. Filter by action with the action box when you know what you are looking for.
5. Read the **Activity History** table and work back from the most recent entry.

## Reference

| Column | What it shows |
| ------ | ------------- |
| Time | When the action happened. |
| Actor | Who performed it. |
| Action | What was done. |
| Entity | What it was done to. |
| Source | Where the action came from. |

## Related

- [Settings](/en/guides/nasnet-linux/settings/)
- [Alerts](/en/guides/nasnet-linux/alerts/)
- [Backup](/en/guides/nasnet-linux/backup/)