> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Activity log

> Review and filter a tenant-wide record of administrator actions, sign-in outcomes, and lifecycle changes in the Iru Identity activity log.

The **activity log** is a running record of significant events in your tenant.
You will find it under **Activity** in the Iru dashboard. Use it to answer
questions like *who changed this setting*, *did that sign-in succeed*, and *when
did this user's access change* - without leaving the console.

<Note>
  The activity log is a read-only history. Events are recorded as they happen;
  you cannot edit or delete them. This makes the log a dependable source for
  reviews and investigations.
</Note>

## What gets recorded

Each entry captures a single event and the context around it. The log brings
together several kinds of events in one place:

<CardGroup cols={2}>
  <Card title="Administrator actions" icon="user-gear">
    Changes administrators make in the console - creating and editing users,
    groups, applications, policies, roles, and settings.
  </Card>

  <Card title="Sign-in outcomes" icon="right-to-bracket">
    The results of sign-in decisions, so you can see whether access was granted
    or denied and follow a person's recent activity.
  </Card>

  <Card title="Lifecycle changes" icon="arrows-rotate">
    Events as people and access move through their lifecycle - for example a
    user becoming active or suspended, or access being granted and removed.
  </Card>
</CardGroup>

## Reading the log

The activity list shows one row per event, sorted with the most recent first.
Each row summarizes the event across these columns:

| Column           | What it tells you                                                             |
| ---------------- | ----------------------------------------------------------------------------- |
| **Occurred at**  | When the event happened.                                                      |
| **Instigator**   | Who or what initiated the event.                                              |
| **Subject type** | The kind of object the event acted on, such as a user, group, or application. |
| **Subject name** | The specific object the event acted on.                                       |
| **Action**       | What was done.                                                                |
| **Status**       | The outcome of the event.                                                     |

Select any row to expand it. The expanded view shows the event's details,
including a **field-by-field list of what changed** - each affected field with
its previous value and its new value - so you can see exactly what an action
modified.

<Tip>
  Sort the list by any column header. Sorting by **Instigator** or
  **Subject name** is a quick way to group everything one administrator did, or
  everything that happened to a single user or app.
</Tip>

## Filtering to what matters

The activity log can grow quickly, so Iru gives you a filter bar above the
list. Build a filter on one or more fields to narrow the view:

* **Occurred at** - restrict to a time window.
* **Instigator** - focus on a specific administrator.
* **Subject type** and **subject name** - focus on a kind of object, or one
  object in particular.
* **Action** - focus on a kind of change.
* **Status** - separate successful events from failures.

Combine conditions to answer a precise question - for example, all events where
the **subject type** is a user and the **status** indicates a failure, within
the last week.

## Save reusable views

When you find a filter you return to often, save it as a reusable **view** so you
can reopen it with one click instead of rebuilding the conditions each time.

<Steps>
  <Step title="Build the filter">
    Add the conditions you want in the filter bar until the list shows the
    events you care about.
  </Step>

  <Step title="Save it as a view">
    Save the current filter as a named view. It joins your list of saved views
    for the activity log.
  </Step>

  <Step title="Reorder your views">
    Drag your saved views into the order that suits your workflow, so the ones
    you use most sit first.
  </Step>
</Steps>

<Info>
  Saved views are available across Iru wherever you filter lists. For example,
  you can save views for your applications list in the same way. A view stores a
  filter you defined; it does not change which events are recorded.
</Info>

## Using the log for audit

Because every significant event is captured with its instigator, subject,
action, outcome, and the exact fields that changed, the activity log doubles as
an audit trail. A few practices make it more useful:

<AccordionGroup>
  <Accordion title="Establish a regular review" icon="calendar-check">
    Save a view for high-signal events - failed sign-ins, role changes, or
    changes to authentication policies - and review it on a schedule so nothing
    unusual goes unnoticed.
  </Accordion>

  <Accordion title="Investigate a specific change" icon="magnifying-glass">
    Filter by **subject name** to pull the full history of one user, group, or
    application, then expand individual events to see precisely what changed and
    who changed it.
  </Accordion>

  <Accordion title="Trace a sign-in" icon="route">
    Filter by **instigator** and **status** to follow a person's recent sign-in
    outcomes when you are troubleshooting access or responding to a report.
  </Accordion>
</AccordionGroup>

<Note>
  For how Iru protects your data and the controls behind your tenant, see
  [Security and privacy](/en/identity/security/security-and-privacy).
</Note>

## Related

<CardGroup cols={2}>
  <Card title="Administrators & roles" icon="user-shield" href="/en/identity/administration/administrators-and-roles">
    Control who can administer Iru Identity and what each administrator can do.
  </Card>

  <Card title="Authentication policies" icon="shield-halved" href="/en/identity/authentication/authentication-policies">
    See the policies that produce the sign-in outcomes recorded here.
  </Card>
</CardGroup>