Skip to content
FlySIPFlySIP Docs

Audit Logs

The audit log records every change made on the switch and every login: which object was touched, what was done to it, who did it, when and from which address. Use it to find out who changed a tariff, who topped up an account, or from where somebody tried to log in with a wrong password.

Where to find it

Section titled “Where to find it”

Open Tools & Debugs → Audit Logs in the left sidebar. The URL is /audit_logs.php. The screen is available to the root customer only, and not to web users with a restricted access level.

Screenshot "admin-panel/audit-logs" has not been generated yet — see scripts/screenshots/screens.yml.

What you see

Section titled “What you see”

The list shows the newest records first, 50 per page, with the total count above it.

Column Meaning
Resource The object that was touched. See Resource
Action The action code. Hover over it for the description. See Action codes
Action by Who did it. See Action by
Date When it happened, in your time zone
User IP/Node The address the request came from, or the id of the switch node for actions the switch did itself

View Details in a row opens Audit Log Details with three more fields: User Agent, the browser or client of the user, and Request by, Request Date and Request IP/Node, the API caller that carried out the request. For a change made in the panel, the request comes from the panel itself; for an API call, it is the API client.

Filter the log

Section titled “Filter the log”

The quick filter matches Resource. Filters opens the other fields:

  1. Enter a pattern in Resource, Action or Action by and choose is like or is not like.
  2. Set Start Date/Time and End Date/Time. By default the list covers the last week up to the end of today.
  3. Click Apply Filter.

Patterns ignore case and match the whole value. Use % as a wildcard: accounts:% finds every record about accounts, %i_account=1234% every record about account 1234, and FUNDS every balance operation.

Download exports the filtered records in your download format with all fields, including User Agent and the request fields.

Read a record

Section titled “Read a record”

Resource

Section titled “Resource”

The resource names the object, usually as table:key=value, sometimes followed by :field=value with the new value. For example:

Resource Meaning
customers:i_customer=15 The customer with ID 15
vouchers:i_voucher=12 The top-up voucher with ID 12
balances:i_balance=40:credit_limit=100 A credit limit set to 100
add:i_account=7:amount=10 USD Add Funds of 10 USD to account 7
recharge:i_account=7:i_voucher=12 Account 7 redeemed voucher 12
account:username=1001 A login attempt with the username 1001

Action by

Section titled “Action by”

Action by has four parts separated by colons: the type of user, its ID, a sub-ID and the login.

Type Who Example
u A web user. The ID is the customer that owns the web user, the sub-ID the web user u:1:3726:main_admin
c A customer, logged in with its default login or calling the API c:15:0:acme
a An account in the self-care portal a:9021:0:1001
v A vendor in the vendor portal v:31:0:carrier1
t A trusted API call or the switch itself. The last part is the IP address or node t:0:0:203.0.113.5

Action codes

Section titled “Action codes”
Code Event
A A record was added
U A record was updated
D A record was deleted
R A deleted record was restored
AUTH_OK Successful login
AUTH_FAIL Failed login
AUTH_OTP Successful login with a one-time password
OTP_RST A one-time password was reset
PSWD_CHNG A web password was changed
FUNDS A balance operation: add funds, charge, credit or voucher top-up
CALL_DISC A call in progress was disconnected
BRUN Billing run of a service plan
BRSTRT The billing cycle of an account was restarted
CLR_FSTUSE The first-use date of an account was cleared
EXT_LFTM The lifetime of an account was extended
Q An action was queued
E A queued action was executed
SSLCRT_ISS An SSL certificate was issued
FW_OPEN80 TCP port 80 was opened in the firewall
MFA_RQRD MFA is required for the login
MFA_PEND MFA is pending until the user sets it up
MFA_SETUP The user finished the MFA setup
MFA_VRFY MFA verification passed
MFA_FAIL MFA was required but failed
MFA_RST MFA settings were reset for all users
MFA_RSTUSR MFA settings were reset for one user
RELAYED An API request was relayed to another environment
Section titled “Related pages”