ts audit

Query the audit log — the record of operator actions such as changing a setting, creating a user, rotating a key, or publishing a policy.

Usage

ts audit [-n=N] [--since=DATE] [--until=DATE] [--event=TYPE] [--csv] [--no-trunc]

Description

Entries are returned newest first. Each records when it happened, who did it and from what address, what was affected, and any details specific to that kind of event.

When more entries match than were returned, ts audit says so, so a truncated window is never mistaken for a quiet one. Narrow with --since/--until or raise -n.

--event filters to a single event type, named as the server names it — GlobalSettingChanged, UserDeleted, SigningKeyRotated, PolicyPublished, DeviceLoginApproved, and so on. The EVENT column shows the type described in words, such as Global setting changed; --format=json carries the name --event takes as eventType. An unknown name is rejected with an error rather than silently matching nothing.

Entries with no user are system-initiated and show as system. An action an administrator took through a first-party service, such as the Administration site, shows the person and the service, as alice in Admin; (asserted) follows when the service named the person without their account.

Options

Flag	Description	Default/Values	Notes
-n, --number	Maximum entries to return.	Default 100; max 2000
--since	Window start.	ISO-8601	E.g. 2026-07-01 or 2026-07-01T09:00:00Z.
--until	Window end.	ISO-8601
--event	Return only this event type.		Rejected if not a known type.
--csv	Tab-separated output, nothing truncated.		For spreadsheets and pipes.
--no-trunc	Do not truncate columns.

Examples

# The last few things anyone did
ts audit -n=20

# One day
ts audit --since=2026-07-29 --until=2026-07-30

# Every settings change this month
ts audit --since=2026-07-01 --event=GlobalSettingChanged

# Who has been approving device-code sign-ins
ts audit --event=DeviceLoginApproved -n=200

# Export for review
ts audit --since=2026-01-01 -n=2000 --csv > audit.tsv

Output

TIME                         USER    EVENT                   TARGET       DETAILS                    IP
2026-07-29T18:15:38.3090000  alice   Notification deleted    Maintenance                             10.2.0.9
2026-07-29T17:58:00.1740000  alice   Server setting changed  node-1       key=SslHsts; from=(unset)  10.2.0.9
Showing 2 of 19 entries; narrow the window or raise -n.

Exit Codes

0 on success, including when nothing matches. -1 when a date or event type cannot be parsed, and when -n is outside 1 to 2000. -5 when the account is not a Server Administrator.

Related Commands

• ts report — Usage, visit, and performance reports as CSV or PDF.
• ts settings — Change the settings whose history appears here.