Using CERMM

Audit log

Every sign-in, command, install, removal and setting change, in plain words. Settings → Audit log.

Who can see it

People with the Audit log privilege.

What's in it

• Sign-ins, failed ones (with the address and why), and recovery codes used.
• Every job: the script that ran, word for word, and who ran it. Scheduled runs say "(scheduled)" under whoever made the schedule. Terminal sessions opened and closed.
• Software pushes, patch installs, playbook runs, approvals and turn-downs.
• Devices added and removed, tags, groups, thresholds, assets, tickets, docs.
• Passwords copied or shown from the vault.
• People invited, changed, suspended and deleted; resets, including deploy/reset-password.sh (as root).

Finding something

Grouped by day. Filter by kind, by text, or by person.

How long

400 days. It can't be edited from the app.