# Audit logging

Axiad Mesh keeps an audit log of administrative and security-relevant activity
in your tenant. Use it to answer who did what, and when — for compliance
reporting, access reviews, and troubleshooting.

## Where to find audit logs

In the Mesh dashboard, go to **Settings → Config Management → Audit Logs**.

The Audit Logs page shows audit records in a table you can review on screen and

## What Mesh audits

The list below is a set of documented examples, not a complete catalog of every
event type Mesh records. New event types are announced in the
[release notes](/release-notes) as they ship.

- **Sign-ins.** Successful sign-in entries include a **Role** column showing
  the role — admin or user — granted at sign-in. Entries where a role doesn't
  apply, such as non-login events, show `-`. Sessions from users with
  different roles display correctly in the same view.
- **Configuration changes.** Changes to integration settings — for example,
  ServiceNow connection details — are recorded with who made the change and
  when.
- **Asset exports.** The audit log captures the full lifecycle of every asset
  export: both the start of the export and its final outcome, success or
  failure. The entries for one export share the same transaction ID, so you
  can trace it from start to finish.
- **AI assistant interactions.** Interactions with the Mesh AI assistant are
  recorded in the audit log.
- **First-run setup.** On a new environment, first-run sign-ins and the
  creation of the first tenant are audited.
- **Edge agent decommissioning.** Decommissioning an on-premises edge agent is
  recorded in your audit log. See
  [Set up an on-prem connector](../connectors/on-prem/set-up-on-prem-connector.md).

## What a record contains

Depending on the event type, an audit record includes:

- **Actor** — the user who performed the action. For example, each asset
  export entry is attributed to the user who initiated the export.
- **Role** — the role granted at sign-in, where applicable. Entries where a
  role doesn't apply show `-`.
- **Transaction ID** — entries that belong to the same operation, such as the
  start and outcome of an asset export, share one transaction ID.
- **Client IP address** — recorded for asset exports triggered through the
  API.
- **Time** — when the event occurred.

### How timestamps display

The **Time** column follows your tenant's timestamp display preference —
**Browser Timezone** or **UTC** — which a tenant administrator sets on the
tenant detail page in the admin area. The column header reflects the selected
time zone, values render in the standardized timestamp format used across the
product, and hovering over a timestamp shows the full value if the column is
too narrow to display it.

## Exporting audit logs

Select **Export** on the Audit Logs page to download the audit log as a CSV
file.

- The export writes records to the file as they're retrieved, so downloads
  complete reliably even for wide date ranges and large datasets of more than
  15,000 records.
- The **Export** button is disabled while an export is running, preventing
  accidental duplicate exports.
- Notifications show that an export is in progress and confirm completion with
  the number of logs exported.
- Records aren't duplicated across page boundaries in the exported file, and
  running several exports back to back works without errors.

> **note**
Timestamps in exported CSV files are always in UTC, regardless of your
tenant's timestamp display preference. This keeps exported data canonical for
downstream processing.

## Retention

This documentation doesn't state a fixed retention period for audit logs.
Audit records are part of your Customer Data — extraction during the term of
your agreement and retrieval after termination are governed by the Customer
Data terms in your agreement. For the retention commitments that apply to
your organization, refer to your agreement with Axiad or contact your Axiad
representative.

## SIEM integration

CSV export from the Audit Logs page is the supported way to move audit-log
data into external tools today. Mesh doesn't currently document a streaming or
API-based delivery mechanism for audit logs. If you need to feed audit logs
into a security information and event management (SIEM) system, contact your
Axiad representative to discuss your requirements.