Skip to main content

Event Log

The Event Log — also called an audit trail — records actions and changes across Trivore ID. Storing every entry forever is rarely practical, so entries are grouped into a few life-time classes with different retention periods, covered in detail below.

Event Log entries are stored in a separate database from application data, due to their much larger volume — very often over 99.9% of all stored data.

Severity levels​

Every Event Log entry has one of six severity levels, from least to most severe: Debug, Information, Warning, Error, Critical, Fatal. When viewing a log (see Viewing and exporting Event Log entries below), the Log Level filter lets you narrow entries down to one or more of these levels — for example, to exclude Debug-level noise, or to focus only on Warning and more severe entries for daily review.

Log Level filter, listing Debug, Information, Warning, Error, Critical, and Fatal

For how long are the logged events stored?​

Event Log entries are split into three life-time classes:

General Event Log items​

The classification for most Event Log items.

Long life-time Event Log items​

Security-related and other Event Log items that legal or compliance reasons require to be stored for a longer time than general items.

Long life-time deletion (purge) is scheduled when the object is deleted permanently (hard-deleted) — the retention period starts counting from that deletion, not from when the item was originally logged.

Permanent Event Log items​

A small, fixed set of items that are kept indefinitely and aren't subject to any retention setting:

  • System initial setup and initial database deployment — normally a one-time event, and the very first Event Log item ever
  • Cluster node (server appliance) startup (always) and shutdown (when possible)

Event Log rotation settings​

General and Long life-time retention periods are configured system-wide at System Preferences → Maintenance → Event Logs, as a number and a unit (days, weeks, or years) for each class. Portal Admin role is required to change these settings.

There's a scheduling service in the platform that purges (permanently deletes) log items once they expire.

See Event Log item life-time base-line usage guidelines for recommended retention periods by industry, and Event Log item expiration example for a worked example of how these life-time classes interact.

Viewing and exporting Event Log entries​

Event Log entries are viewed per object, rather than in one global list. Most management views have an Info menu with one or more options for viewing entries related to the selected item — for example, on Accounts, Changes to account shows entries that target the account (changes made to it), while View account actions shows entries where the account was the actor (actions it performed). On Namespaces, Changes to namespace shows entries targeting the namespace.

Each Event Log dialogue can be filtered by date range (a preset such as This week or Last 12 months, or a custom range), Log Level, Event ID, actor/target type and identifier, and event text. Select Actions → Export Event Log items to export the entries currently shown, as CSV with a choice of delimiter and quote character.

Visibility follows the same role scope as other management data: Namespace Admin and Namespace Auditor accounts see entries for objects in their own namespace, while Portal Admin and Portal Auditor accounts can see entries for any namespace.

Last updated on