How to use the audit trail
The Audit tab records who did what, when, and on which resource. It is where you go to answer "who gave this person access?" or "when was this contract changed?".
Despite living inside the IAM screen, the trail is not limited to access changes — it also records contract, customer and virtual machine actions.
Prerequisites
- The
iam:audit:viewpermission. Without it the Audit tab does not appear at all.
What gets recorded
| Area | Examples |
|---|---|
| Users | invited, updated, archived, blocked, unblocked |
| Groups | created, updated, permissions changed, archived, deleted |
| Assignments | group assigned to a user, assignment removed |
| Direct grants | created, renewed, revoked |
| Contracts | created, updated, suspended, resumed, canceled, renewed |
| Customers | created, updated, archived |
| Virtual machines | selected sensitive actions |
| Effective permissions | when someone inspects another user's access |
That last one is deliberate: looking at what another person can do is itself recorded.
Reading an entry
Each entry carries:
- Who — the actor's name, plus the IP address and browser the action came from.
- What — the action, and the target it applied to.
- Where — the scope the action happened in, when the action is scoped.
- Why — the reason typed by the actor. This is why several screens require a reason before confirming.
- Before and after — for changes, a snapshot of the values on each side, so you can see exactly what moved.
Finding an entry
Filter the list by actor, action, target, or a date range, and use the search box for free text. Results are paginated, newest first.
To investigate one person, opening their user detail and looking at their access is usually faster than filtering the whole trail.
Notes
- You only see your own tenant. The trail is filtered to your organization, regardless of the filters you apply. EdgeX staff see across tenants.
- Entries are never edited or deleted from the interface — that is the point of an audit trail.
- The reason field is only as useful as what people type in it. "Ticket #4521, new SRE on the weekly deploy" answers a question six months from now; "ok" does not.