Audit, sign-in and notification logs

The Logs tab in Observability records every request made to DataMind OS, every notification the platform sent, and every single sign-on attempt. Use it to find out who did what and when, or whether an email went out. This page covers the Audit and Notifications sub-tabs; SSO login logs covers the sign-in records.

Open a log

1. In the sidebar, open Observability, then click Logs.
2. Click Audit, SSO Logs or Notifications. You see only the sub-tabs your permissions allow. The SSO Logs, AI, Sockets and PII sub-tabs are documented on their own pages: SSO login logs, AI, socket and PII logs, Socket logs and PII detection logs.
3. Set Period, then search or filter the columns.
4. Click a row to open its details on the right. Use the copy buttons to copy IDs.
5. Close the details with the close button.

The sub-tab you used last opens first. It is remembered in your browser, not on your account. If a remembered sub-tab is not open to you, Audit opens instead.

Find out what a user did

Each row in Audit is one request made to DataMind OS, brought together from its request, response and error records. The main columns are Date & Time, Method, URL, User, Acting as, Status Label, Status, Response Time (ms), Error Message, Request ID and IP Address. Further columns include Controller, Handler, End Time, Body Size, Content Length, Params, Query and Body.

Status Label reads as a success, an error or pending, whatever wording the record uses. The Response Time (ms) badge marks slowness: it warns from 100 ms and stands out from 500 ms.

To see what a user did yesterday:

1. Open Observability > Logs > Audit.
2. Set Period to Custom and pick yesterday's date.
3. Filter the User column for that person.

Click a row to see its details. The panel shows the method, the status, the response time with a speed label (Fast, OK or Slow), the URL, the user, the Request and Response sizes and the IP. Below that, the Request section shows the Request ID, Status, Controller and Handler. A request that failed also shows an Error section, with a Stack trace where one was recorded. Query params, Route params and Request body follow; an empty value reads No message, No query params, No route params or No request body. One-click copy is available for values such as the URL, the request ID, the error message, the stack trace, the params, the query and the body.

When an administrator acts as another user (see Impersonate a user), User shows the person being acted as, and Acting as shows who really made the request.

What is stored, redacted or left out

• Sensitive values are replaced with [REDACTED] before the record is stored: body fields whose names suggest a secret, such as password, token, secret or card, wherever they sit in the body, and sensitive headers as well.
• Some requests are stored without their content on purpose. Paths that carry a secret keep no query or body at all, and AI chat traffic keeps its content in the AI log instead.
• When a user has switched off DataMind Oda content logging, requests are stored without their content: the URL is kept without its query string, and a failure keeps only the name of its error.
• Map tile and map style requests are never recorded, so they cannot flood the log, and preflight requests are never shown.
• Requests are recorded even when they fail or are stopped early by the platform's request limits.

Check whether a notification was sent

1. Open Observability > Logs > Notifications.
2. Set Period, then filter Source or Status. For a scheduled DataPrism report, filter Source to DataPrism.
3. Read Status, Delivered to and Rejected.
4. Click the row to open Notification Send. It shows When, Source, Target, Channel, Trigger, Attempt, Recipients, Delivered to, Duration, Attachment, Actor user, Subscription, Message ID, Integration, Target ID and Log ID. Rejected recipients and the Error appear in their own sections.

The table lists each send with Date & Time, Status, Source, Channel, Target, Format, Trigger, Attempt, Recipients, Delivered to, Rejected, Error, Duration and Attachment.

The same table also appears inside a workflow's alerts window, on its Execution tab, limited to that workflow: there the Source and Target columns are hidden, and its Period is remembered separately. See Failure alerts.

Channels are set up in Notifications. The Notifications tab lists the values you will see:

• Sent: every recipient was accepted.
• Partial: some recipients were accepted and others rejected. Delivered to lists the accepted ones, and Rejected lists the others with the reason.
• Failed: no recipient was accepted. Each intended recipient appears under Rejected with the reason.

For email, Delivered to lists the recipients the mail server accepted. Alert emails appear here with the source Alert. To find out why an alert email did not arrive, see Manage alerts.

Export logs

1. Set Period, and filter or search as needed.
2. In the export control in the toolbar, pick CSV, Excel, JSON or TSV, then click the download icon next to it. Its tooltip reads Download as and the format.

The export contains the rows that match your period, filters and search, and the file is named after the log it comes from. One export holds up to 300,000 rows. The export control appears only if your role has the matching export permission; see Permissions below.

Periods, limits and settings

The period, filter and export controls behave the same way across the Observability tables; the shared details are described under Observability.

If a log cannot load, or a refresh fails after rows are on screen, the table says so and offers Retry. The message list is in Observability troubleshooting.

Permissions

Permissions decide which sub-tabs you see and whether you can export. Presets are assigned in Roles and permissions. The full list is in the Permission reference.

To open the Logs tab at all, you need View Audit Log. Without it, the other sub-tabs are hidden too. SSO Logs has its own permissions, listed on SSO login logs.

Questions, answered

Can I see what an administrator did while acting as me?

Only if you can open the logs, which needs View Audit Log. Requests made while an administrator acted as another user show that user in User and the administrator in Acting as.

Why do some audit rows have no request body?

The platform leaves out content it must not store. Requests on paths that carry a secret keep no query or body at all, and AI chat traffic keeps its bodies in the AI log instead. When content logging is switched off, a request is recorded without its content. The request itself is still recorded in every case.

What does [REDACTED] mean in the audit log?

A value the platform must not keep readable. Body fields whose names suggest a secret, such as password, token, secret or card, are replaced with [REDACTED] wherever they sit in the body, and the same goes for sensitive headers.

Which requests never appear in the audit log?

Map tile and map style requests are left out, so they cannot flood the log, and preflight requests are never shown. Everything else is recorded, including requests that fail or are stopped early by the platform's request limits.

Why does a request have no status yet?

A request is recorded as soon as it arrives. Until its answer is recorded, there is no final status. Refresh the table to see whether the answer has arrived.

Did the scheduled DataPrism report email go out?

Open Logs > Notifications, filter Source to DataPrism, and check Status and Delivered to. A Sent or Partial status means the mail server accepted it for at least one recipient.

What does Partial mean in Notifications?

Some recipients were accepted and others were rejected. Delivered to shows the accepted ones, and Rejected shows the refused ones with the reason.

Are password reset emails logged?

Yes. They appear under Notifications with Source set to Password reset.

Why is the export option missing on a log?

Each log has its own export permission, such as Export Audit Log. Ask an administrator to give your role the matching Manager preset or export permission.

Why don't I see the Notifications sub-tab?

You need View Notification Logs for that sub-tab. You also need View Audit Log to open the Logs tab at all. Ask an administrator to add the preset; see Roles and permissions.