Audit Log

A searchable record of who changed what, and when.

Last updated Aug 14, 2026View as Markdown

Overview

Every administrative action is written to the Audit Log: settings changes, subscription edits, server and Xray operations, backups and restores. It is the record you reach for when something changed and nobody remembers changing it, and the one place that ties an action to an actor and a timestamp.

Before you start

  • How long entries survive is set by retention_audit_logs_days under Settings → Data Retention. Set it to 0 to keep entries forever.
  • The Telegram bot can also surface the audit log through an admin command.

Steps

  1. Open Audit Log from the sidebar.
  2. Check Total Events at the top for the size of the record.
  3. Narrow by Entity Type, a dropdown that starts at All entities.
  4. Filter by action with the action box when you know what you are looking for.
  5. Read the Activity History table and work back from the most recent entry.

Reference

Column What it shows
Time When the action happened.
Actor Who performed it.
Action What was done.
Entity What it was done to.
Source Where the action came from.