The audit log shows various changes in your Zendesk account since the account was created. It saves a record of these changes indefinitely, and you can view the entire change history. You can view the audit log in Admin Center or via the Support API.
This article contains the following sections:
About the audit log changes
There are two key things to understand about the audit log: the types of changes captured and the details provided for each log entry.
Changes captured in the audit log
The audit log tracks changes that agents and admins have made to your Zendesk account. End user activities are not captured.
The audit log shows changes to the following areas:
- Account information and settings
- Users (updates to existing users only; activities related to creating new users are not captured)
- Apps
- Web Widget
- Business rules
- Ticket settings
- Organizations
- Custom objects
Audit log entries
For each entry in the audit log, the following information is included:
Column | Description |
---|---|
Time | Time and date the event occurred |
Actor | User or system that caused the event |
IP address | IP address of the user who caused the event |
Item | Object changed by the actor |
Activity type | Type of action for the event (Created, Updated, Deleted, Exported, or Signed in) |
Activity | Details about the event |
In the Zendesk API and Zendesk Support, audit log timestamps appear in Coordinated Universal Time (UTC). In Admin Center, audit log timestamps are shown in your account's time zone. See Setting your account's time. If you are unsure of what time the audit log is using, hover your mouse pointer over the information icon in the Time column heading.
Viewing the audit log in Admin Center
From the Audit Log page in Admin Center, you can view the audit log as a whole, sort the log by time, filter the list, or export a copy of the log.
- In Admin Center, click Account in the sidebar, then select Audit log > Audit log.
Filtering the audit log
Often, only part of the picture is available when you visit the audit log. For example, you might know when something changed (but not what) or who changed something (but not when). Since the audit log can include a large volume of events, filtering makes it easier to find what you’re looking for.
While top audit events are available as filters, not all event types can be filtered. Additional audit events will be added over time.
To filter the audit log
- In Admin Center, click Account in the sidebar, then select Audit log > Audit log.
- Click the Time column to sort the entries by date.
- To use more filters, click Filter.
Additional filters appear in a side drawer.
- To find entries within a specific date range, enter a Start date and End date.
-
Enter a name in the Actor field to filter by the people or systems responsible for the activities.
- Select an Activity type to filter entries by the action type (Created, Updated, Deleted, Exported, or Signed In).
- Use the filters in the Item section to filter by a specific
setting, user, or business rule that has changed.
- In the Type field, select or search the generic item type you want to filter by (for example, "Trigger").
- In the Names field, select or search for the specific items you want to filter by (for example, the trigger named "Notify assignee of comment update").
- Click Apply filters.
Exporting the audit log
You can export a CSV formatted copy of the audit log. If you filter the list before starting the export, the CSV file is also filtered this way. The exported copy is emailed to your primary Zendesk email address.
To export a copy of the audit log
- In Admin Center, click Account in the sidebar, then select Audit log > Audit log.
- Filter the audit log as needed.
- Click Email CSV.
95 comments
Monica
Nice updates to add Date filtering. I'd love for filtering around what was changed like role edited for an agent or view activated/deactivated, etc.
5
Nick DeSpain
I emailed a CSV to myself and it looks like it's using UTC time. Is there a way I can change that?
1
Kharlo Reboja
Hi Nick,
Thanks for reaching out. Timestamps can be displayed in different time zones across your Zendesk account, depending on your configuration.
However, the CSV export file that you can extract from this feature is in UTC.
For more information take a look at the link below:
https://support.zendesk.com/hc/en-us/articles/115000353048-Which-time-zone-does-Zendesk-use-
0
Ak N
Hi,
Does the Maximum number of agents for your account under Account Changes include the count of Light Agents too or is it only agents who take up a license?
Also, is there any way I can check the total number of contracted licenses for an account through the API?
Thanks in advance.
1
Brett Bowser
Hey Ak,
Excellent question! Light agents will not count towards your max number of agents on the account.
I did some digging on my end and it doesn't look like there's an endpoint for contracted agent licenses currently. That being said, you could use the search users endpoint. In your search query, you will want to include the role ID for agents and admins on your account. This will at least allow you to pull a list of your agents who are using up a license on your Support account.
I hope this helps!
1
Ak N
Hey Brett,
Thanks for the quick response.
I was just curious about what the Max agents in the audit log correspond to then? In the article above it is mentioned we can find out the Maximum number of agents for your account under the Account Changes in the audit log.
There is an entry in the audit log with the source_type:account and description:Max agents changed from X to Y. I was trying to understand what the definition of Max agent in this entry is.
Any information in this regard would be much appreciated.
Thanks!
0
Brett Bowser
Hey Ak,
That means the max number of agent licenses you have on the account. Not exactly how many of those seats you've filled up but how many agent seats you've purchased on your plan level.
Does that sound like what you're looking for?
0
Ak N
Hey Brett,
Yes this is what I am looking for. My use case is to look at the total number of seats I have available on my plan, and to compare it with the total number of seats allocated to an agent(which I can get using the search user endpoint).
Thanks!
0
Ak N
Hey Brett,
Just following up on the above comment again,
This mean that the Max agents number mentioned in the audit log here shows the number of licenses I have paid for right?
Apologies for opening this thread again, but I got this doubt when I was going through your reply again.
Thanks!
0
Brett Bowser
Hey Ak,
That's correct! Max Agents = the number of licenses you purchased on the account.
I hope this clears up any confusion!
0
Halley
The filter option is no longer available, right? Or was it move somewhere different?
0
Caroline Kello
Could you give some more detail, Lina? Nothing's changed on our end.
0
Daniël Nieuwendijk
Is there a way to monitors changes made to requesters' data?
0
NIkita Kadri
Hi Team
Is there a way to add Account assumptions too as part of Audit log? information related to Granting account assumption, Support team logins and disabling the assumption?
1
Caroline Kello
Hi Nikita,
Changes related to the Account Assumption setting is already reflected in the Audit log, but it's a good catch on the logins that happen from Zendesk staff based on the assumption being granted. I've added a task to our backlog to investigate how we'd be able to present this. Thanks for your feedback.
0
Megan Lalock
I wanted to throw out some feedback on this:
For basic functionality the filtering is great if you know exactly what you are trying to find however, if you are trying to find a specific change the filtering that is provided doesn't help. It would be nice to be able to filter by each column or even keywords like a typical search uses. The reason I say this is because if someone changes a trigger or view, it would be easier to just use "View changed" or "trigger changed" to find something instead of having to comb though insignificant data.
I am aware that I can download this into a csv to filter it that way but really that shouldn't be necessary to find what Admins need.
3
Dave Dyson
Hi Megan,
Thanks for this feedback – would you mind upvoting and adding a comment with your use case to this product feedback thread? Overwhelmed by noise in audit log.
1
Khajik Khajadourian
We need to be able to search the audit log by the user that was changed, not just the actor making the change. Is there a plan to implement this in the audit log or am I not seeing how to do this?
1
Fluke Corporation
Can the audit log be set up as EXPLORE report query? It would be nice to be able to have Agent Log In times (for example) and have that an automated report sent to the Managers. Thank you
2
Caroline Kello
Khajik Khajadourian The user that was changed will be displayed in the Item column; there's no way to filter by this column at the moment but that work is being discussed and designed at the moment so it's something that we're actively working towards.
Fluke Corporation It's not on our short term roadmap but I do see the value in having the audit log be available in Explore for reporting purposes. Maybe some pre-canned dashboards too.
0
Thomas D'Hoe
There is a mistake in the documentation (see paragraph below):
Tickets
The thing is that I just tested this and it is not possible to find "ticket field modification" in the audit log.
0
Caroline Kello
Hey Thomas, we should capture updates made to the ticket fields 🧐 Can you tell me which update you made that didn't show in the audit log for you and I can take a closer look?
1
Thomas D'Hoe
Hi Caroline, so far I can 👀, the modification part isn't logged.
- I created a ticket field " Test" > Log ✅
- I changed the name of the ticket field "Test" into "Tes" > Log ❌ (This should be logged as I modified the field?)
- I deactivated the ticket field > Log ❌(I don't know if this should be logged?)
- I deleted the ticket field > Log ✅
0
Caroline Kello
Hi Thomas, thanks for that! Sorry I got confused between Ticket fields and Ticket forms; we did some recent work into Ticket forms which should capture creation, deletion, modification - but you're right that the same isn't true for Ticket fields. I'll remove the modification call-out for Ticket fields from this article and put a story on our backlog to close this gap. Thanks again and apologies for the incorrect info.
0
dianakurth
Hi Caroline,
thank you for this answer. Could you tell us whether there is another way to see the modifications done in ticket fields? (namely by whom?)
Thanks
0
Dwight Bussman
dianakurth - if this is a one-off request and the changes occurred within the last 30 days, our Support team should be able to see this in logs. I recommend contacting support as documented here to have someone help with this: https://support.zendesk.com/hc/en-us/articles/4408843597850
0
dianakurth
Hi Dwight, thank you. This means indeed if changes <30 days you may see it.
But within an instance, even an admin cannot, right?
0
Dwight Bussman
That's correct. Changes to ticket-fields are not included in the audit-log at this time.
0
Craig VanDeVenter
I would like to port the audit log into a monitoring system to alert my team if certain changes occur. I don't see that anyone has asked this question just yet. I'm not asking for report or filtering. I'm asking if anyone has ever, or knows anything out there, that can access the logs.
We want teams to be alerted if "X" changes in the log, for example.
For example... are the logs available to a custom API? We are using Looker and we could use looker as a middle man on this if possible. IF so... where do I find the logs in the directory?
Any help is appreciated.
1
Dwight Bussman
HeyO Craig VanDeVenter
For your question "are the logs available to a custom API" - the API for Audit Logs are documented here: https://developer.zendesk.com/api-reference/ticketing/account-configuration/audit_logs/
I'm not sure if this answers your question, but if Looker can pull logs down from our REST API to ingest, hopefully that'll suffice.
0