Audit log
The record of changes made to a network in the console, through the API and by Peerlify — what is recorded, how to search it, and its limits.
Updated · ·By Ivan Vyshniak
Nothing on this page changes with your selection.
The audit log records changes made to a network: settings, devices, members, access rules, keys and billing. It is available on every plan.
Open Logs in the console. The Admin panel tab is the audit log; the Networking and Shadowing tabs are the activity logs. Viewing the log requires the Owner, Admin, IT admin, Network admin or Auditor role.
Find entries
- Range:
1h,24h(default),7d,30d,90d, or Custom with From and To dates. - Search: matches the action code (such as
device.rename), the target's name and type, and the name and email of the person who made the change. - All actions: limits the list to one action, from those present in the selected range.
Each row shows the Timestamp (in your local time), the Action, the User who made the change, and the Target. Click a row to see its details: usually the values before and after the change. For Updated access controls, the row expands to a diff of the policy against the previous version.
Who is shown as the actor
- The person who made the change in the console, with their email.
- Peerlify when Peerlify staff made the change, when it was made through the REST API, or when the person's account has since been deleted.
- Entra ID (SCIM) or Okta (SCIM) when your identity provider made the change through user and group provisioning.
What is recorded
Changes made in the console:
| Action | Shown as | Recorded when |
|---|---|---|
network.create | Created network | A network is created. |
network.update | Updated network settings | A setting on the Settings page changes. |
network.delete | Deleted network | A network is deleted. |
device.rename | Renamed device | Edit name. |
device.change_ip | Changed device IP | Edit IP. |
device.replace_tags | Replaced device tags | Edit tags. |
device.set_key_expiration | Toggled key expiry | Disable/Enable session expiry. |
device.set_membership_status | Changed membership status | A device is approved. |
device.set_exit_point_approval | Device — set exit point approval | Approve as exit point / Revoke exit point. |
device.trigger_update | Triggered device update | Update on a device. |
device.leave_network | Removed device from network | Remove from network. |
member.invite_link_created, member.invite_email_sent | Member — invite … | An invite is created. |
member.invite_accepted | Member — invite accepted | Someone joins through an invite. |
member.approved | Member — approved | A pending member is approved. |
member.role_change | Changed member role | A role changes. |
member.remove | Removed member | A member or a pending invite is removed. |
acl.update | Updated access controls | The access policy is saved or restored, including exit-point rules. Also written by "Peerlify" when exit-point rules were introduced, and when revoking or removing an exit point deletes its rule. |
tag.create, tag.delete, tag.set_managed_by | Created tag, Deleted tag, Tag — set managed by | Tags change. |
auth_key.create, auth_key.revoke | Created auth key, Revoked auth key | Auth keys change. |
api_token.create, api_token.revoke | Api token — … | API tokens change. |
webhook.create, .update, .delete, .rotate | Webhook — … | Webhook endpoints change. |
exit_point_policy.create, .update, .delete | Exit point policy — … | Exit-point policies change. |
session.revoke | Revoked session | Force log out on a device. |
billing.* | Billing — … | Subscriptions, seats and payment methods change. |
Changes made through the REST API record network.update, acl.update, tag.create, tag.delete, user.role_changed, user.approved and user.removed. Changes made by Peerlify staff record network.update, billing.plan_granted, billing.quota_override, network.suspended and network.unsuspended.
Provisioning
Changes your identity provider makes through provisioning are recorded with Entra ID (SCIM) or Okta (SCIM) as the actor; setting provisioning up in Settings → Provisioning is recorded with the person who did it. Updates that change nothing aren't recorded. The same entries appear under Recent events in Settings → Provisioning.
| Action | Recorded when |
|---|---|
scim.enable, scim.disable | Provisioning is turned on or off. scim.disable shows Peerlify as the actor when Peerlify staff turned it off. |
scim.token.rotate, scim.token.revoke | The provisioning token is rotated or revoked. |
scim.settings | Only provisioned users can join is changed. |
scim.user.create | Your identity provider adds a user. |
scim.user.binding_missing | Your identity provider adds a user without a usable user ID (Can't be linked). |
scim.user.update | A user's details change. |
scim.user.bind | A provisioned user is linked to the person who signed in. |
scim.user.suspend, scim.user.reactivate | Your identity provider deactivates or reactivates a user. |
scim.user.delete | Your identity provider deletes a user; they are suspended and removed 30 days later. |
scim.user.restore | A deleted user is added again within the 30 days. |
scim.user.purge | A deleted user is removed after the 30 days. |
scim.group.create, scim.group.update, scim.group.delete | A synced group is added, renamed or changes members, or is deleted. |
scim.group.conflict, scim.group.release | A synced group gets or loses a Name conflict, for example because a policy group with the same name was added to or removed from the policy. When a policy save caused it, the person who saved the policy is the actor. |
Limits
- Not everything is recorded. Provisioning updates that change nothing, test webhook deliveries and changes made by devices themselves (sign-ins, exit-point offers) aren't recorded here. Changes made through the REST API are recorded only for the actions listed above.
- Deleting a network files the Deleted network entry under the network that was active in your console at the time, so it may not be visible afterwards.
- There is no export. To keep a copy, use the search and range filters and save the pages you need.
- Retention: entries aren't deleted automatically.
- No IP address or browser information is recorded.