Reading the Audit Log

Open the audit log

Click Audit Log in the left navigation. The page reads your organization’s signed cloud audit trail through Velauth Cloud.

For directory writes, the Agent that performed the AD change signs the record, and the broker checks it against the authenticated operator before accepting it. The Audit Log page does not use the desktop app’s local log file as its primary source.

What the table shows

Column	Description
Timestamp	When the operation was recorded
Operator	The Velauth operator associated with the operation
Action	The directory action that was attempted or completed
Target	The affected directory object, when present
Outcome	Success, failure, or intent
Hash	Not available for cloud rows in the current app and shown as `()`

Select a row to open its details in the panel beside the table.

Filter entries

Use the controls above the table to filter the entries already loaded:

Date range: All time, Today, This week, This month, or a custom from/to range.
Operator: match an operator name.
Action: match an action name.
Target: match a target.
Outcome: All, Success, or Failed.

Choose Clear to remove all filters, or Refresh to load the cloud trail again.

The app currently requests up to 200 entries, or up to 2,000 when the organization’s plan includes extended audit history.

Local integrity warning

Velauth also keeps a device-local, HMAC-chained audit cache. At Audit Log startup, the app checks the recent part of that local chain and its head anchor.

This check is a secondary, fail-open health signal. It does not replace or verify the signed cloud trail, and a failed check does not block the app. If the check finds a problem, a persistent Local device cache integrity check failed warning appears. Record the warning and contact your security or support team.

Export availability

The current Audit Log page has no CSV, download, or export control. Audit export is not yet available in the Tauri desktop app.