The audit trail is a record of each time a ticket is updated, whether by a person or by a business rule such as a trigger. By looking at the audit trail, you can see the complete history of a ticket.
The audit trail shows all of the events and notifications that occur with each ticket update. Events are ticket properties that are added, removed, or changed. Notifications are external communications associated with the events. You can also click the ID next to a notification to preview the email sent for that notification.
When you're viewing a ticket, you can find audit trail details by clicking the Conversations drop-down and selecting Events.
Reviewing ticket events can help you trace the path of a ticket and troubleshoot any issues. For example, you can see whether a trigger has fired or what type of browser the end-user was using.
When you click Events, some or all of the following might appear, depending on what was changed or added to the ticket for that ticket update. If a field's value was changed, the new value appears along with the crossed-out previous value, allowing you to easily see what changed. For example, if an agent changed a ticket status from Open to Pending, the update appears in Show all events like this:
Subject: The subject of the ticket
- Group: The group responsible for the ticket
- Organization: The organization associated with the ticket
Type: The type of the ticket (Incident, question, problem, or task)
Status: The status of the ticket (new, open, pending, on-hold, solved, or closed)
Requester: The person who created the ticket
Priority: The priority of the ticket (low, normal, high, or urgent)
- Assignee: The agent assigned to the ticket
Custom field: A custom field an administrator has added to the ticket form
- CCs: Anyone who was CC'd on the ticket
In addition to new and changed ticket properties, you can see triggers, automations, and email communications that occur in the background with ticket updates.
- Trigger: Any triggers that have affected the ticket, such a trigger that notifies the assignee
- Message pushed to target: A message sent to a cloud-based third-party target, like JIRA or Yammer
At the bottom of the information you see when you click Show all events, you can view details about the submitting users' location, browser, and IP address.
- Submission channel: If a ticket is submitted through a channel other than the web form, such as Twitter or email, details about the channel appear.
User agent string: A string that identifies browser information and other system details
IP address: The IP address used for that ticket update
Location: The IP location for that ticket update. Keep in mind that this might not be the same location as the actual user.