---
title: Find events in the audit log
description: "Filter the audit log by person, action, resource, result, and time, so you can find one upload, one deletion, or one failed sign-in."
section: Audit log
order: 20
audience: [owner, admin]
status: published
lastVerified: 2026-09-15
sources:
  - web/src/components/app/audit/AuditFilters.tsx
  - web/src/components/app/audit/useAuditEvents.ts
  - web/src/components/app/audit/AuditEventDialog.tsx
---

1. Open **Audit log** and pick the **Organisation** or **Authentication** tab.
2. Set the filters you need.
3. Select **Apply**.

**Clear** puts every filter back to the default: all events from the last seven days.

## The filters

| Filter | What it does |
| --- | --- |
| **User** | Shows one person's events. Enter their user ID, not their email. |
| **Action** | One kind of event, like **Upload**, **Delete**, **Role updated**, or **Login failed**. |
| **Resource** | Organisation tab only. Narrows to members, roles, permissions, buckets, objects, or authentication. |
| **Result** | Organisation tab only. **Allowed** or **Denied**. |
| **From** and **To** | The time range, in your computer's time zone. |

To find someone's user ID, select any of their events and copy the **User ID** from the details.

## Common searches

- **Who deleted a file?** Action: **Delete**, then look for the file name in the Resource column.
- **Why can't someone open a folder?** User: their ID, Result: **Denied**. The rows show exactly which bucket and path were refused.
- **Failed sign-in attempts.** Authentication tab, Action: **Login failed**.

## Nothing shows up

Try clearing filters one at a time, and widen the time range. Also check that you're in the right organisation, and on the right tab.

Remember that events older than 14 days are gone for good. And no row doesn't always mean nothing happened: some actions, like changes made directly in your storage provider's console, never pass through quickS3.