Audit log: user action log
Who changed campaigns, offers, users and settings, when and from where — and how to find the record you need.
Audit log is a tab of the Logs section: Admin panel → Logs → Audit log («Админ-панель → Логи → Audit log»). It records actions in the panel and API requests that change something: who performed them, when, from which IP and with what result. The owner and the admin can see the section.
What gets into the log
Actions that create, change, delete or start something are recorded:
- actions in the panel and requests made with an API token;
- actions of all roles, including those that cannot access the Logs («Логи») section;
- successful and failed attempts, including access denials;
- clearing logs and switching the Log («Логировать») toggle on the neighboring tabs;
- building a report;
- AI client requests to MCP reports.
The dashboard and the campaign page update their metrics by themselves while they are open. Each update is a create record with the reports resource. To see only changes, filter the records by resource or action.
The log does not record:
- viewing sections and data, except building a report and MCP requests;
- logging in to the panel;
- incoming postbacks and form submissions from landing pages;
- requests made without logging in to the panel and without a valid token.
The log does not store the content of changes: a record has no old or new field values.
The log is kept separately for each workspace. New records are on top, 100 per page.
Table columns
| Column | What it contains |
|---|---|
| Context («Контекст») | UI — an action in the panel. API — a request made with an API token. micatorctl — an owner password change with a command on the server. trackerctl — the same on a server of an earlier release, where the installation service has not been updated yet and the command has this name |
| Date and time («Дата и время») | When the action was performed, in the browser's time zone |
| Action («Действие») | What was done — see the values |
| Resource («Ресурс») | What it was done to — see the values |
| ID | The object ID. Empty if the action does not apply to a single object: creating a new one, saving settings, changing your own password. For some operations it contains their name, for example activate or policy |
| User («Пользователь») | The login of the person who performed the action — see API tokens and “Log in as” |
| IP | The address the request came from |
| User Agent | The browser or program. A long value is truncated and shown in full on hover |
| Status («Статус») | The tracker's response code. Green — up to 399, red — 400 and above |
The ID column holds a long identifier, not a number like #12 from the lists. To copy the ID of a campaign, offer or landing page, click its number in the ID column of the list.
On a phone, records are shown as cards without the User Agent.
Action values
| Value | What happened |
|---|---|
create | An object was created or an operation was started: a check, a preview, a delivery retry, a license activation, an action with a backup or an update, building a report, a change of access to a campaign, offer or landing page |
update | An object or a setting was changed. Pausing, enabling and archiving a campaign from the panel are also update |
delete | An object was deleted or a log was cleared. Offers and landing pages go to the trash |
clone | A copy of a campaign, stream, offer or landing page was created |
uploadArchive | A ZIP archive was uploaded to an offer or landing page |
saveFileData | A file was created or saved in the file editor |
deleteFile | A file was deleted in the editor |
verify | A domain check was started |
share | The list of team members with access to a domain group was changed |
impersonate | An owner or admin opened the panel as a user with the Log in as ↗ («Войти как ↗») button |
setPassword | An owner or admin set a password for a user |
changePassword | A user changed their own password |
read | An AI client sent a request to MCP reports. The resource of such a record is mcp |
owner_password | Root set a new owner password with the sudo micatorctl owner-password command. The User column shows root (micatorctl), IP and User Agent are empty. If the server has only the earlier trackerctl command, the context and the User column show trackerctl and root (trackerctl) |
create does not always mean a new object. Resource and ID tell you what exactly was done: retention and preview — a log cleanup estimate, license and activate — a license activation.
Resource values
| Value | What it refers to |
|---|---|
campaigns | Campaigns. Stream creation, stream order and the stream selection check are also recorded here with the campaign ID |
streams, stream-templates | Changing, deleting and copying a stream, saving a stream as a template, deleting a template |
campaign-groups, offer-groups | Renaming and deleting a campaign or offer group |
offers, landers | Offers and landing pages, including uploading an archive and files, renaming files and versions |
editor | Saving and deleting a file in the editor. The ID column holds the offer or landing page ID |
page-trash | Restoring a campaign, offer or landing page from the trash |
traffic-sources, affiliate-networks | Sources and affiliate networks |
domains, domain-groups | Domains, including pointing to a reverse proxy node, and domain groups |
proxy-nodes, cf-accounts | The Reverse proxy nodes («Реверс-прокси ноды») section: nodes and Cloudflare accounts |
users, profile | The Team («Команда») section and the My profile («Мой профиль») window |
reports, report-views, report-exports | Building a report, saved reports, CSV exports |
mcp | AI client requests to MCP reports |
automations | The Automation rules section: creating, changing, pausing and deleting a rule, checking conditions |
shared-funnels | The Shared funnels section: creating a funnel, a new version, previewing changes, applying a version, unlinking a stream and deleting a funnel |
deliveries | Retrying a send in the delivery log |
logs | Clearing a log or switching the traffic log. The ID column holds the log: system, postback, s2s or traffic; for the toggle — traffic-enabled |
settings | Settings → General («Настройки → Основные») and bot lists |
ip2proxy, geo-profiles | Settings → Bots and GEO («Настройки → Боты и гео») |
conversion-types, conversion-import | Settings → Conversions («Настройки → Конверсии») and Conversion import («Импорт конверсий») |
custom-metrics, currency-rates | Settings → Metrics («Настройки → Метрики») and Currencies («Валюты») |
blocklist-sources, domain-replacements | Settings → PL registry («Настройки → Реестр PL»): registry sources and returning a replaced domain |
license, api-tokens | Settings → License («Настройки → Лицензия») and API |
spend | Settings → Spend («Настройки → Расходы») and spend uploads from the extension |
retention, backups, updates | Settings → Retention («Настройки → Хранение»), Backups («Резервные копии») and Updates («Обновления») |
API tokens and “Log in as”
The User column shows the login of the person who performed the action. Two cases look different:
- A request made with an API token. The context is
API, and the login of the token creator is followed by the beginning of the token in square brackets:admin [trk_1a2b3c4d…]. The same beginning is shown in the token row in Settings → API («Настройки → API») — it tells you which token was used. - “Log in as” mode. The column shows two logins with an arrow:
admin → john_buyer. On the left is the owner or admin who acted, on the right is the user they logged in as. The one on the left counts as the performer.
Logging in as a user itself is a separate record with the impersonate action and the users resource.
Search and filters
Above the table are a search line and a row of filters.
| Field | How it searches |
|---|---|
| Find («Найти») | Part of a word, case-insensitive, in the action, resource, ID and the User column. Does not search by IP, User Agent or status |
| Resource | The whole value, case-sensitive, for example campaigns |
| Action | The whole value, case-sensitive: uploadArchive, not uploadarchive |
| User ID («ID пользователя») | The performer's full ID, not the login. To search by login, use the Find field |
| From («С») | Records from this moment on, inclusive |
| To (exclusive) («До (не включая)») | Records strictly before this moment. The value must be later than From |
| Outcome («Исход») | All («Все»), Success («Успешно») — status from 200 to 399, Error («Ошибка») — status 400 and above |
The date and time in the From and To (exclusive) fields are set in the browser's time zone, as in the table.
Quick search:
- Enter text in the Find field, for example a media buyer's login or a campaign ID.
- Click the Find button or press Enter.
Precise filtering:
- Fill in the filter fields you need.
- Click Apply («Применить»).
The conditions add up: a record must match all filters and the text in the Find field. Filters take effect after you click Apply; the Find button only takes already applied filters into account. The Reset («Сбросить») button clears the filters and the search line.
Example: who changed a campaign
- In the Campaigns («Кампании») section, click the campaign's number in the ID column — the ID is copied.
- Open Admin panel → Logs → Audit log.
- Paste the ID into the Find field.
- Click the Find button.
The list shows changes to the campaign, its copying and stream creation. Changes to streams that already exist are recorded with the stream ID and do not appear here.
Retention period
By default, automatic cleanup is off and records are kept indefinitely. There is no Clear («Очистить») button here as on the neighboring tabs: old records are deleted on the Settings → Retention tab.
- The Keep last days («Сохранять последние дни») field — from 7 to 3650, 90 by default.
- The Estimate cleanup («Оценить очистку») button shows how many records are older than the period and opens the Clean up now («Очистить сейчас») and Enable daily cleanup («Включить ежедневную очистку») buttons.
- One run deletes up to 10,000 of the oldest records. They cannot be restored.
- Runs are shown in the Cleanup history («История очисток») table.
The steps are described on the Data retention and audit log cleanup page.
FAQ
Can I export the log to a file?
There is no export button on the tab. You can get the records through the API — see Action log.
A team member says they changed nothing, but there is a record
Check the User, Context and Resource columns:
- a record like
admin → john_buyer— the action was performed byadminin Log in as ↗ mode; - the
APIcontext — the request came with an API token created by this user, not from the panel; - the
createaction with thereportsresource — building a report while viewing, not a change.
What does a red status mean?
A status from 400 to 499 means the tracker rejected the request: insufficient permissions, the data did not pass validation or the object was not found. A status of 500 and above is an error during execution: open the object in the panel and check whether the change was saved.
There are no records
Nothing matched the conditions. Check that:
- the values in the Resource and Action fields are entered in full and with the correct case;
- the User ID field contains an ID, not a login;
- the period covers the time you need.
The Reset button brings back all records.
The end of the period must be later than the start («Конец периода должен быть позже начала»)
The To (exclusive) value is earlier than or equal to the From value. Correct the period and click Apply.