Audit log
See who changed what in your workspace, from the dashboard, the CLI, the API, an AI agent or Synq itself. Filter the log, open an entry for the before and after, and choose how long entries are kept.
The audit log records every change made in a workspace: deploys, domain and certificate changes, members and access, server operations, settings, sign-in security and what AI agents did. Each entry says who did it, when, from where, and what changed.
Open it
Choose Audit log at the bottom of the sidebar (under Settings), or go to /audit on your panel.
Who can read it: workspace owners and admins, and restricted members who were granted the Audit log resource. Members don't see entries. See Permissions and roles.
Find an entry
- Category tabs across the top: All, Deployments, Apps & services, Domains & SSL, Servers, Members & access, AI agents, Security, Billing and System, each with its count. Billing is normally empty on your own server, since hosted billing is switched off in Synq.
- Search ("Search apps, servers, domains, people…") matches events, actors and resources.
- Anyone narrows the log to one person.
- Period: All time, Today, Last 7 days, Last 30 days or Last 90 days.
- Source: Everything, Dashboard, AI assistant, CLI, API, Webhook or System. With AI assistant, a second filter picks one agent (Any agent, or a connected client with its number of events).
- Clear filters resets everything. The filters live in the page address, so you can bookmark or share a view.
Entries are grouped by day (Today, Yesterday, then dates), and a line such as "Showing 1-50 of 320" tells you where you are in the results.
Read an entry
Open an entry to see:
| Field | What it shows |
|---|---|
| Who, Email | The person, or System for Synq's own jobs |
| Came from | Dashboard, CLI, API, webhook, AI assistant or system |
| Agent | The AI client, when an agent made the change |
| When | The exact time |
| IP | The address the request came from |
| Resource | What was changed |
| Changes | Before and After for every field that changed, and Removed values |
| Technical details | The Event type (for example server.docker_cleanup), the resource Type and ID, the User ID and the User agent |
A few events from running your server, as they appear in the log:
| Event | When |
|---|---|
| Docker cleanup | A cleanup removed images, containers, build cache or volumes (by hand or on schedule). The details list the items and bytes freed. |
| Docker cleanup schedule changed | The schedule, scope or servers of the scheduled cleanup changed. |
| Panel backup settings changed / Panel backup started | The panel backup settings changed, or someone pressed Back up now. |
| Certificate contact email changed | The Let's Encrypt contact email was set or cleared. |
To see what one AI agent did, open Settings, MCP and press Activity on that client: it opens the log filtered to it.
Choose what is kept
At the top of the page:
- Record activity turns recording on or off for the workspace. It is on by default. While it is off, nothing new is added and the page says so; existing entries stay.
- Keep entries for: 7, 30, 90, 180 or 365 days. The default is 90 days. The built-in job Audit log prune deletes older entries every day.
Only owners and admins can change these two settings ("Only owners and admins can change this.").
From the API
| Call | What it does |
|---|---|
GET /api/audit | List entries, with the same filters as the page |
GET /api/audit/facets | The counts behind the tabs and filters |
GET /api/audit/settings | Whether recording is on, and the retention |
PATCH /api/audit/settings | Change them: { "enabled": true, "retentionDays": 180 } |
Reading needs audit:read; changing the settings needs audit:write. See the Audit API.
Related guides
Two-factor authentication
Protect a Synq login with a code from an authenticator app. Turn it on in Settings, save your backup codes, sign in with a code, and get back in with synq reset-admin-password if the owner loses the phone.
Email & webmail
Run your own self-hosted mail server and a webmail app with Synq — provision it, manage domains and mailboxes, and put an inbox in the browser.