The audit trail
Security > Audit is one list of everything that happened on this server, newest first. It is the one place that answers "who did this, and when" without your having to know whether the answer lives in the job list, a log file or a container's output.
What it records
| Category | What lands in the trail |
|---|---|
| Work | Every job people queued and every job the scheduler ran |
| Changes | Every configuration change, server and instance |
| Access | Every sign-in and every failed sign-in, with the address it came from |
| Data | Every download |
| Refusals | Every refused request and every rejected API key |
| License | Every license change, and one row per feature, instance or account the license switched off and per one it brought back. See When the license changes |
| The host | Every local ohm command, with its credentials masked |
That last row is the one people are surprised by. A command run on the host, by someone with a shell and no console account, is still an act on this server, and it is recorded like any other - the credentials it carried are masked before the row is written, not after.
A command run as root on the server itself shows as system:root, source cli-local, and so does
the work it hands to the management API. An ohm install or an update run on the host is therefore
one actor from start to end, the same one its jobs name as the requester, rather than the
console's own key.
An act done through the key of a console that manages this server shows the person as the actor, with the source environment; an act of the Odoo Management Plane shows the source plane. Either way the row carries the address the key connected from, and its detail ends with the key's name, so you can tell which key did it and revoke that one.
Reading it
Filter by time, actor, action, outcome, target, address and source, and export the result as CSV.
Every row is stamped with when the act began, and the list is ordered by that. For an act that
takes a while, such as a local ohm command, the export's last column, completed, says when it
ended, so a command that failed after five minutes does not look as if it failed the moment it
started. It is empty for an act that has no separate end. A support bundle's copy of the trail has
the same column.
pelmo$ ohm server audit --server pelmoThe command line lists the same trail, which matters when the thing you are investigating is the console.
Who can read it, and who can delete from it
Both administrator roles read it - Administrator and Read-only administrator. Operators and Viewers do not.
Nobody can delete from it. There is no delete action, on any page, at any edition, for any role. A trail an administrator can edit answers a different question from the one it appears to answer, so the product does not offer it.
How long it is kept
A year by default, pruned by the Job and audit history retention maintenance operation.
That operation is housekeeping, so
it runs at every edition including unregistered. Change the window with Api:Audit:RetentionDays -
see Configuration and state.
Rows older than the window are deleted, not moved somewhere cheaper. If you need to keep more than a year, export before the prune reaches it, or raise the window and give the master database the room.