Audit Logs Module Documentation

Module Overview (Technical)
Module Overview (Commercial/Business)
Module Overview (End User/Administrator)
Log Fields Reference
Common Scenarios & Examples
Limitations & Important Notes
Troubleshooting Tips
Glossary

---

1. Module Overview (Technical)

What Are Audit Logs?

Audit Logs is a security and compliance module that records all administrative actions performed in the system. It tracks who did what, when, from where, and provides a complete audit trail for regulatory compliance and security monitoring.

Architecture

Plaintext

┌─────────────────────────────────────────────────────────────────┐
│                  Audit Logs Architecture                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Admin Performs Action                                          │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Any Module (Extensions, Users, Gateways, etc.)    │   │
│  │                                                          │   │
│  │  User clicks [Save] / [Delete] / [Create]                │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ API Call with User Context                              │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Backend Middleware                                │   │
│  │                                                          │   │
│  │  Log entry created:                                      │   │
│  │  ├─ Action: CREATE / UPDATE / DELETE / LOGIN / etc.      │   │
│  │  ├─ Resource: extension / user / gateway / etc.          │   │
│  │  ├─ Resource ID: 123                                     │   │
│  │  ├─ User: admin@example.com                              │   │
│  │  ├─ IP Address: 192.168.1.100                           │   │
│  │  ├─ User Agent: Chrome/120.0                            │   │
│  │  └─ Metadata: JSON (old/new values)                      │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼                                                         │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        public.audit_logs                                 │   │
│  │                                                          │   │
│  │  id | action | resource | user | ip | timestamp | meta   │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Display in Viewer                                       │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Audit Logs Page                                   │   │
│  │                                                          │   │
│  │  [Filters: Date | Action | Resource | User]              │   │
│  │                                                          │   │
│  │  ┌─────────────────────────────────────────────────────┐ │   │
│  │  │Time      │Action │Resource│User    │IP          │...│ │   │
│  │  ├──────────┼───────┼────────┼────────┼────────────┼───┤ │   │
│  │  │10:30:45  │UPDATE │extens  │admin   │192.168.1.10│...│ │   │
│  │  │10:25:12  │CREATE │user    │admin   │192.168.1.10│...│ │   │
│  │  │10:20:00  │DELETE │gateway │admin   │192.168.1.15│...│ │   │
│  │  └─────────────────────────────────────────────────────┘ │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Key Tables

Table	Purpose
`public.audit_logs`	Audit trail records

Key Files

File	Description
`modules/auditLogs/`	Frontend module
`modules/auditLogs/api/auditLogApi.ts`	API calls
`modules/auditLogs/types/auditLog.types.ts`	Type definitions

---

2. Module Overview (Commercial/Business)

Business Value

Audit Logs provides complete accountability:

Without Audit Logs	With Audit Logs
Unknown who changed	Full accountability
No change history	Complete trail
Compliance gaps	Regulatory compliance
Security blind spots	Activity visibility

Use Cases

Security Monitoring

- Track administrator activity

- Identify suspicious actions

Compliance

- SOC 2 requirements

- HIPAA audit trail

- PCI DSS logging

Troubleshooting

- "Who changed this?"

- Configuration change history

Investigation

- Security incident response

- Forensic analysis

Feature Highlights

Feature	Benefit
Action Tracking	What was done
User Identification	Who did it
IP Logging	Where from
Timestamp	When it happened
Metadata	What changed
Search/Filter	Find specific events

---

3. Module Overview (End User/Administrator)

What Can You Do?

View all system activity
Filter by date range
Filter by action type
Filter by resource
Filter by user
Search across logs
Export for compliance

Audit Logs Interface

Plaintext

┌─────────────────────────────────────────────────────────────────┐
│              Audit Logs                                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  View and analyze system audit logs and user activity           │
│                                                                 │
│  Filters:                                                       │
│  ├─ Range: [Today ▼] [01/16/2026] to [01/16/2026]              │
│  ├─ Actions: [All Actions ▼] (CREATE, UPDATE, DELETE...)       │
│  ├─ Resource: [                    ]                           │
│  ├─ User: [All Users ▼]                                        │
│  └─ [🔄 Refresh] [Clear Filters]                               │
│                                                                 │
│  🔍 [Search by action, resource, or user...              ]     │
│                                                                 │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │Timestamp    │Action │Resource  │Res ID│User  │IP Address │  │
│  ├─────────────┼───────┼──────────┼──────┼──────┼───────────┤  │
│  │01/16 10:30  │UPDATE │extension │ 123  │admin │192.168.1.1│  │
│  │01/16 10:28  │CREATE │user      │ 456  │admin │192.168.1.1│  │
│  │01/16 10:25  │DELETE │gateway   │ 789  │super │10.0.0.5   │  │
│  │01/16 10:20  │LOGIN  │session   │  -   │admin │192.168.1.1│  │
│  │01/16 10:15  │UPDATE │queue     │ 101  │admin │192.168.1.1│  │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                 │
│  Showing 1-25 of 1,234 records                                  │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Quick Tips

TIP

Quick Ranges: Use Today, 7 Days, 15 Days, 30 Days for fast filtering.

TIP

Multi-Action Filter: Select multiple action types to filter.

NOTE

Metadata: Click row to view full metadata with old/new values.

---

4. Log Fields Reference

Display Columns

Column	Description
ID	Unique log entry ID
Timestamp	When action occurred
Action	Type of action
Resource	What was affected
Resource ID	Specific item ID
User	Who performed action
IP Address	Source IP
User Agent	Browser/client info
Metadata	Additional details

Common Actions

Action	Description
CREATE	New record created
UPDATE	Record modified
DELETE	Record removed
LOGIN	User logged in
LOGOUT	User logged out
EXPORT	Data exported
IMPORT	Data imported

Common Resources

Resource	Description
extension	SIP extension
user	System user
gateway	SIP gateway
queue	Call queue
ivr	IVR menu
route	Inbound/outbound route
domain	Tenant domain
session	Login session

---

5. Common Scenarios & Examples

Scenario 1: Who Changed Extension 1001?

Filter Resource by "extension"
Search for resource ID or number
View action history
Check metadata for changes

Scenario 2: Security Investigation

Filter by specific user
Set date range for incident window
Review all actions
Export for report

Filter Action by "LOGIN"
Review login times and IPs
Identify unusual patterns
Check for failed logins

Scenario 4: Compliance Report

Set date range for reporting period
Apply relevant filters
Export full log
Submit for audit

---

6. Limitations & Important Notes

Technical Notes

NOTE

Automatic Logging: All admin actions are logged automatically.

NOTE

Read-Only: Audit logs cannot be modified or deleted.

WARNING

Storage: Long retention periods increase storage needs.

Retention

Setting	Description
Default Retention	Configured per system
Compliance Needs	May require 1-7 years

Best Practices

Regular Review: Check logs weekly for anomalies
Export Archives: Export and archive regularly
Monitor Logins: Watch for unusual login patterns
Track Deletions: Review all DELETE actions
IP Awareness: Know your admin IPs

---

7. Troubleshooting Tips

Common Issues

Symptom	Possible Cause	Solution
No logs	Too restrictive filter	Clear filters
Missing action	Not logged	Check if action type is logged
Slow loading	Large date range	Reduce date range
User not found	User deleted	Search by user ID
No metadata	Not captured	Some actions have limited metadata

Diagnostic SQL

Recent audit entries:

Sql

SELECT 
  timestamp,
  action,
  resource,
  resource_id,
  user_email,
  ip_address
FROM public.audit_logs
ORDER BY timestamp DESC
LIMIT 50;

Actions by user:

Sql

SELECT 
  action,
  COUNT(*) as count
FROM public.audit_logs
WHERE user_email = 'admin@example.com'
  AND timestamp >= NOW() - INTERVAL '24 hours'
GROUP BY action
ORDER BY count DESC;

---

8. Glossary

Term	Definition
Audit Log	Record of system activity
Action	Type of operation performed
Resource	Type of object affected
Metadata	Additional change details
User Agent	Browser/client identification
Audit Trail	Complete history of actions

---

Lua Script Status ℹ️

No Lua Handler Required

Component	Status
Audit Logs	ℹ️ Backend-logged - recorded by API middleware

Audit Logs is a frontend reporting module. Logging is performed automatically by the backend middleware when API calls are made. No Lua handlers are used.

---

Documentation last updated: January 2026

Audit Logs Module Documentation

Table of Contents

1. Module Overview (Technical)

What Are Audit Logs?

Architecture

Key Tables

Key Files

2. Module Overview (Commercial/Business)

Business Value

Use Cases

Feature Highlights

3. Module Overview (End User/Administrator)

What Can You Do?

Audit Logs Interface

Quick Tips

4. Log Fields Reference

Display Columns

Common Actions

Common Resources

5. Common Scenarios & Examples

Scenario 1: Who Changed Extension 1001?

Scenario 2: Security Investigation

Scenario 3: Login Audit

Scenario 4: Compliance Report

6. Limitations & Important Notes

Technical Notes

Retention

Best Practices

7. Troubleshooting Tips

Common Issues

Diagnostic SQL

8. Glossary

Lua Script Status ℹ️

No Lua Handler Required