Find events in the audit log

Filter the audit log by person, action, resource, result, and time, so you can find one upload, one deletion, or one failed sign-in.

Owner Admin

Open Audit log and pick the Organisation or Authentication tab.
Set the filters you need.
Select Apply.

Clear puts every filter back to the default: all events from the last seven days.

The filters

Filter	What it does
User	Shows one person’s events. Enter their user ID, not their email.
Action	One kind of event, like Upload, Delete, Role updated, or Login failed.
Resource	Organisation tab only. Narrows to members, roles, permissions, buckets, objects, or authentication.
Result	Organisation tab only. Allowed or Denied.
From and To	The time range, in your computer’s time zone.

To find someone’s user ID, select any of their events and copy the User ID from the details.

Common searches

Who deleted a file? Action: Delete, then look for the file name in the Resource column.
Why can’t someone open a folder? User: their ID, Result: Denied. The rows show exactly which bucket and path were refused.
Failed sign-in attempts. Authentication tab, Action: Login failed.

Nothing shows up

Try clearing filters one at a time, and widen the time range. Also check that you’re in the right organisation, and on the right tab.

Remember that events older than 14 days are gone for good. And no row doesn’t always mean nothing happened: some actions, like changes made directly in your storage provider’s console, never pass through quickS3.