ts audit

Query the audit log — the record of operator actions such as changing a setting, creating a user, rotating a key, or publishing a policy.

Usage

ts audit [-n=N] [--since=DATE] [--until=DATE] [--event=TYPE] [--csv] [--no-trunc]

Description

Entries are returned newest first. Each records when it happened, who did it and from what address, what was affected, and any details specific to that kind of event.

When more entries match than were returned, ts audit says so, so a truncated window is never mistaken for a quiet one. Narrow with --since/--until or raise -n.

--event filters to a single event type, named as the server names it — GlobalSettingChanged, UserDeleted, SigningKeyRotated, PolicyPublished, CliLoginApproved, and so on. An unknown name is rejected with an error rather than silently matching nothing.

Entries with no user are system-initiated and show as system.

Options

Flag	Description	Default/Values	Notes
-n, --number	Maximum entries to return.	Default 100; max 2000
--since	Window start.	ISO-8601	E.g. 2026-07-01 or 2026-07-01T09:00:00Z.
--until	Window end.	ISO-8601
--event	Return only this event type.		Rejected if not a known type.
--csv	Tab-separated output, nothing truncated.		For spreadsheets and pipes.
--no-trunc	Do not truncate columns.

Examples

# The last few things anyone did
ts audit -n=20

# One day
ts audit --since=2026-07-29 --until=2026-07-30

# Every settings change this month
ts audit --since=2026-07-01 --event=GlobalSettingChanged

# Who has been approving command-line sign-ins
ts audit --event=CliLoginApproved -n=200

# Export for review
ts audit --since=2026-01-01 -n=2000 --csv > audit.tsv

Output

TIME                         USER    EVENT                   TARGET       DETAILS                    IP
2026-07-29T18:15:38.309Z     alice   Notification deleted    Maintenance                             10.2.0.9
2026-07-29T17:58:00.174Z     alice   Server setting changed  node-1       key=SslHsts; from=(unset)  10.2.0.9
Showing 2 of 19 entries; narrow the window or raise -n.

Exit Codes

0 on success, including when nothing matches. -1 when a date or event type cannot be parsed. -5 when the account is not a Server Administrator.

Related Commands

• ts report — Session, usage, and share reports as CSV or PDF.
• ts settings — Change the settings whose history appears here.