Audit log
What is recorded, and what is not
Edit this pageOn this page
Every privileged action is recorded with the actor, the address it came from and what changed. Settings → Audit.
What is recorded
| Category | Examples |
|---|---|
| Access | Sign-in, sign-out, failed sign-in, SSO callback, session revoked |
| Membership | Invitation sent, accepted, member removed, role changed, site scope granted |
| Credentials | Created, updated, deleted, tested |
| Daemons | Enrolled, renamed, deleted, key revoked |
| Configuration | SSO provider changed, integration added, AI settings changed |
| Inventory | Network added or removed, scan enqueued or cancelled, finding triaged |
| Data | Snapshot taken, share link created or revoked, export produced |
Each entry carries the actor (or the API key, for machine actions), a timestamp, the source address and a structured description of the change.
What is not recorded
- Reads. Loomscope does not log who looked at which host. An access log of an inventory tool is mostly noise, and the ones that do it end up unreadable.
- Credential values. The audit log records that a credential was changed, never what it was changed to.
- Session tokens or API keys. Same redaction as the application log.
Source addresses behind a proxy
The address recorded is the one the request appeared to come from. Behind a
reverse proxy that means the proxy, unless it sets X-Forwarded-For — so
every entry reads as 127.0.0.1 until the proxy is configured. See TLS and
reverse proxy.
This is worth fixing before you need the log rather than after.
Who can read it
auditor, admin and owner. The auditor role exists precisely so that
someone can be given the audit trail without being given the ability to
change anything — the two are separate concerns and the role model treats
them that way.
Retention and export
Entries are retained indefinitely; there is no automatic pruning. For an estate under change, budget for it — see Scaling.
Export is by database query today. There is no log-shipping integration; the application log is structured JSON on stdout and can be shipped with whatever you already use, but the audit log is a table.
Using it after an incident
Three questions it answers well:
"Who changed this?" Filter by entity. The entry names the actor and the before-and-after.
"What did this account do?" Filter by actor. Includes machine actors — an API key is an actor with a name.
"When did access change?" Filter by category. Membership and credential events are the ones that matter here, and they are the ones people reconstruct from memory when there is no log.