Skip to content
StatusOwlDocs

Audit logs

What StatusOwl records, how to filter it, who can read it, and what is deliberately not captured. Included on every plan.

Last updated

The audit log records state changes in your organization — who did what, when, and from which IP. It is what you reach for during a security review, a post-incident debrief, or a compliance question.

Audit logging is included on every plan, including Free. It is not a paid add-on and never has been.

What gets recorded

State-changing actions across the product, including:

ActionRecorded against
monitor.created / .updated / .deletedThe monitor's UUID
status_page.created / .updated / .deletedThe page's UUID
integration.created / .updated / .deletedThe integration's UUID and type

Incidents, incident updates, maintenance windows, member changes, billing actions and API key operations are recorded too. The table above lists the categories the dashboard filter offers today.

Each entry carries:

  • Timestamp in UTC.
  • User — who did it.
  • Action and the resource type plus resource ID affected.
  • IP address, resolved through the proxy layer.
  • User agent.
  • Metadata — a JSON object with action-specific detail, typically old versus new values on an update.
  • Impersonation marker — if a StatusOwl staff member was acting on your behalf for support, the entry shows both the apparent user and the impersonator. This is rare and surfaced explicitly.

Reading the log

Open Organization → Audit Logs. Fifty entries per page, with:

  • Search across action, resource type, resource ID, user email and metadata.
  • Action filter — narrow to one event type.
  • Resource type filter — monitors, status pages, integrations.
  • Date range — start and end pickers.
  • Row expansion — the full metadata object, IP and user agent.

Who can read it

Owner and Admin only. Billing, Member and Viewer cannot open the page. See Roles & permissions.

Retention

Audit entries are kept for as long as the organization exists. They are not subject to the per-plan check-data retention window, which applies only to time-series check results.

Export

There is no self-serve CSV or JSON export. The dashboard renders entries as a filterable table. For a bulk extract, contact hello@statusowl.net. Self-serve export is on the roadmap.

What is not recorded

  • Reads. Opening a dashboard or listing monitors writes nothing. The log is about change, not browsing.
  • Check results. Those live in the time-series store, not here.
  • Status page traffic. Visitor analytics are a separate concern and are not in the audit log.
  • Per-request API logs. Keys carry a last-used timestamp and an aggregate request count (see Managing API keys); individual request logs are not exposed.

What people use it for

  • Security review. "Every integration created in the last 30 days" — filter by integration.created and a date range.
  • Post-incident. "Did anyone touch this monitor in the hour before it broke?" — filter by the monitor's UUID.
  • Onboarding hygiene. "Did the new admin stay inside their remit?" — filter by user.

See also