Read the audit log: what an agent did and whether it was allowed

In the Beta build, the Audit logs page lists the newest 200 actions agents took on your machine, with When, Actor, Action, Target and Outcome columns; it is on the Free edition too.

Last checked against the app on · View as Markdown

Steps

  1. Press Ctrl+K and choose Audit logs. This works on every edition, including Free. On Personal or Business you can also open it from the Dashboard: in the "Guard activity" panel, press "Open all activity".
  2. Read the heading: "Every action an agent took, and whether it was allowed."
  3. Read the table. The columns are When, Actor, Action, Target and Outcome. When is shown in your local time.
  4. Read the Outcome badge. It says Completed, Denied, Failed or Not recorded. Denied means the guard refused on your behalf. Not recorded means the log did not note an outcome for that action. It does not mean the action worked.
  5. Narrow the list with "Search the log". Type an agent, an action, or what it acted on.
  6. Use the Outcome menu to show All outcomes, Completed, Denied or Failed.
  7. Press Refresh to read the log again. The page reads it once when you open it and does not update by itself. "Last read at" shows when it was last read.
  8. Know the limit. The page shows the newest 200 actions. When it has reached that many it says "Showing the newest 200 actions in the log. Older actions are not listed here."

How to tell it worked

After an agent has acted, pressing Refresh brings its action into the table, and "Last read at" shows the new time.

If it does not work

The page says "No actions recorded yet".
Nothing auditable has happened in this vault yet. Entries appear as agents act.
The page says "This log records no outcomes" when you filter by Outcome.
The log has no outcome for any action it read, so an outcome filter cannot match. Press "Clear filter" to see every action.
The page says "Could not read the audit log".
Press "Try again". If it keeps failing, quote the message shown in a bug report.
An action you expect is not listed.
It may be older than the newest 200, or it happened after the page last read the log. Press Refresh.