View the audit logs in Raytha

The audit log answers "who changed this, and when?" Every successful change made through the admin is written to it with the person's email, the time and the IP address. Use it to trace a mistake, review what a new administrator did, or confirm that a change really happened.

What you need

The Manage Audit Logs permission. It is one of the eight system permissions; see Manage administrators, roles and permissions.
To change how long entries are kept, or to clear the log, you also need Manage System Settings.

Open the audit log

In the sidebar, open Observability > Audit log.
The page is headed "Who changed what, and when." and lists entries newest first, 50 to a page. Use Previous and Next to move through pages.

If Audit log is not in the sidebar, your roles do not include Manage Audit Logs.

Read an entry

Column	What it shows
When	The time of the change. Click the heading to sort.
Category	The kind of change in words, for example "Edit content item", "Create user" or "Edit role". Click the heading to sort.
User	The email of the person who made the change. If an administrator was signed in as someone else with impersonation, a second line reads "via" followed by the administrator's email.
IP	The address the request came from.

Click the arrow at the start of a row (Show changes) to open the details: the request Raytha received, as formatted JSON, with the item's id and the fields that were sent. Click it again (Hide changes) to close it. If nothing was recorded the panel reads "No change details were recorded."

{
  "Id": "3m1kQWm0wUeV9n6d1j8o2A",
  "Title": "Spring sale",
  "Password": "[redacted]"
}

Values that could be used to break in are replaced with [redacted]: anything named like a password, secret, token, API key, certificate or credential, plus the SMTP user name. So you can show the log to a colleague without exposing credentials, but it also means you cannot recover a changed password from it.

Find an entry

Use the filters above the table. They combine, so each one you add narrows the list.

Filter	Use it to
Category	Show one kind of change, such as only role edits.
User	Show one person's changes. Type their complete email address; part of an address matches nothing, and an invalid address is rejected.
From and To	Limit to a date range. Both days are included in full.

The page also has a Search entries box. In this release it does not narrow the list, so use the filters above and open rows to read the details.

For example, to find out who edited content last week: set From and To to last week, choose the "Edit content item" category, then open the rows and look for the title in the details.

What is recorded

Raytha records changes, grouped by area:

Content: content items, content types and fields, views, media items.
Design: themes, web templates, widget templates, site pages, menus, email templates.
People: administrators, roles, public users, user groups.
Settings: configuration, SMTP, authentication schemes, webhooks, Functions, maintenance actions.
Sign-ins: successful sign-ins and the start of impersonation.

Only changes that succeeded are written. A rejected form, a failed sign-in or a request refused for permissions leaves no entry. Reading a page or a list is not recorded either.

How long entries are kept

Raytha deletes audit entries older than the retention window every day at 03:00 UTC. The default is 180 days.

Open Settings > Maintenance.
In Data retention, find the Audit log row. It shows how many rows exist and how old the oldest one is.
Enter a number of days from 0 to 3650 and click Save. Enter 0 to keep entries forever.

You should see a message such as "Audit log keeps 365 days". To delete the whole log immediately, click Clear now in the same row and confirm. The clear cannot be undone, but the new log starts with one entry recording that it was cleared and by whom.

The email log, webhook deliveries and finished background tasks have their own rows. See Update configuration and system-wide settings.

Gotchas

The log shows what was sent, not a before-and-after. You see the values someone submitted, not the previous values. To get an earlier version of a content item, use its revisions. See Revisions and publishing.
Changes made with an API key may show no user. A key is checked on each request and does not sign a person in, so the User column can be empty for such changes. See Create an API key for the headless REST API.
Times are shown in your browser's time zone and locale, not the site's Time zone setting. The From and To days are also read in your browser's time zone.
The email log is separate. The audit log does not list the messages Raytha sent. Use Observability > Email log, which needs Manage System Settings.
Old entries disappear on schedule. If you need a longer history for compliance, raise the retention days before the entries reach the limit.