SetFN
SetFNDocsOctober 27, 2026

Checking the Audit Log

The audit log records user activity in the Team Space, Personal, Mail, and Auth areas in chronological order. This document explains how to search the log by condition and what each column in the list means.

Before you begin

  • Required permission: an administrator with access to activity logs
  • Required license: Team or higher

Opening the Audit Log

In the administrator screen, select Operations & Audit > Activity Logs.

Audit log

Setting Search Conditions

You can narrow the results by combining the conditions at the top of the screen.

  1. Select an area: Choose the area to view logs for — Team, Personal, Mail, or Auth.
  2. Select a period: Choose Today, Yesterday, Last 7 days, or Last 30 days, or choose Custom range and enter a start date and an end date.
  3. Search: Choose a search field — User (name or ID) or Action Type — enter a search term, and select the Search button.

Changing any condition reloads the list, and the number loaded on the current page is shown at the top right as Showing N. This is not the total number of search results.

Reading the Log List

The list includes the following columns.

ItemDescription
TimeWhen the action occurred
UserThe nickname of the user who performed the action
Action typeThe type of action performed, e.g. file_create, file_modify, edit, comment_create
TargetThe path of the file or folder the action was performed on
ScopeThe area where the action occurred (Team, Personal, Mail, Auth)

Use the < (Previous page) and > (Next page) buttons at the bottom of the list to move between pages.

Administrator settings change records

When an administrator changes security or policy settings, or handles user accounts and permissions, blocks, device approvals, or two-factor authentication, the action is recorded in the Auth scope. The Action type column shows the name of the action (for example Security settings changed, Block added, User permissions changed, Device approved, Two-factor enabled, Two-factor disabled, Recovery codes regenerated, Two-factor reset), and the Target column lists each changed item with its previous and new value in the form before -> after, together with the administrator who made the change and the client IP. Secret values such as passwords and keys are not recorded.

Good to Know

  • Clicking a row does not open a detail view. The list shows all available information about each action.
  • There is no option to export the log to a file.