The audit log shows various changes in your Zendesk since the account was created. It saves a record of these changes indefinitely, and you can view the entire change history. You can view the audit log in Admin Center, or via the Support API
This article contains the following sections:
About audit log changes
The audit log shows changes to account information and settings, users, apps, web widget, business rules, tickets, and organizations. For each entry in the audit log, the following information is included:
| Column | Description |
|---|---|
| Time | Time and date the event occurred. |
| Actor | User who caused the event |
| IP address | IP address of the user who caused the event |
| Item | Object changed by the actor |
| Type | Type of action for the event (Created, Updated, Deleted, Exported, or Sign in) |
| Activity | Details about the event |
In the Zendesk API and Zendesk Support, audit log timestamps appear in Coordinated Universal Time (UTC). In Admin Center, audit log timestamps are based on browser locale.
Viewing the audit log in Admin Center
From the Audit Log page in Admin Center, you can view the audit log as a whole, sort the log by time, filter the list, or export a copy of the log.
- In Admin Center, click the Account icon (
) in the sidebar, then select Audit log > Audit log.
Filtering the audit log
The audit log can be filtered by data, actor, or type.
To filter the audit log
- In Admin Center, click the Account icon () in the sidebar, then select Audit log > Audit log.
- Click the Time column to sort the entries by date.
- To filter the entries, click Filter, and then add your filter criteria. Click Start date and End date to set a date range, enter a name in the Actor field to filter by the people or system responsible for the activities, or select one or more Type of activity.
By default, the filter date range is set to the last 12 weeks.
- Click Apply filters.
Exporting the audit log
When necessary, you can export a CSV formatted copy of the audit log. If you filter the list before starting the export, the CSV file is also filtered this way. The exported copy is emailed to your primary Zendesk email address.
To export a copy of the audit log
- In Admin Center, click the Account icon () in the sidebar, then select Audit log > Audit log.
- Filter the audit log as needed.
- Click Email CSV.
47 Comments
Nice updates to add Date filtering. I'd love for filtering around what was changed like role edited for an agent or view activated/deactivated, etc.
I emailed a CSV to myself and it looks like it's using UTC time. Is there a way I can change that?
Hi Nick,
Thanks for reaching out. Timestamps can be displayed in different time zones across your Zendesk account, depending on your configuration.
However, the CSV export file that you can extract from this feature is in UTC.
For more information take a look at the link below:
https://support.zendesk.com/hc/en-us/articles/115000353048-Which-time-zone-does-Zendesk-use-
Hi,
Does the Maximum number of agents for your account under Account Changes include the count of Light Agents too or is it only agents who take up a license?
Also, is there any way I can check the total number of contracted licenses for an account through the API?
Thanks in advance.
Hey Ak,
Excellent question! Light agents will not count towards your max number of agents on the account.
I did some digging on my end and it doesn't look like there's an endpoint for contracted agent licenses currently. That being said, you could use the search users endpoint. In your search query, you will want to include the role ID for agents and admins on your account. This will at least allow you to pull a list of your agents who are using up a license on your Support account.
I hope this helps!
Hey Brett,
Thanks for the quick response.
I was just curious about what the Max agents in the audit log correspond to then? In the article above it is mentioned we can find out the Maximum number of agents for your account under the Account Changes in the audit log.
There is an entry in the audit log with the source_type:account and description:Max agents changed from X to Y. I was trying to understand what the definition of Max agent in this entry is.
Any information in this regard would be much appreciated.
Thanks!
Hey Ak,
That means the max number of agent licenses you have on the account. Not exactly how many of those seats you've filled up but how many agent seats you've purchased on your plan level.
Does that sound like what you're looking for?
Hey Brett,
Yes this is what I am looking for. My use case is to look at the total number of seats I have available on my plan, and to compare it with the total number of seats allocated to an agent(which I can get using the search user endpoint).
Thanks!
Hey Brett,
Just following up on the above comment again,
This mean that the Max agents number mentioned in the audit log here shows the number of licenses I have paid for right?
Apologies for opening this thread again, but I got this doubt when I was going through your reply again.
Thanks!
Hey Ak,
That's correct! Max Agents = the number of licenses you purchased on the account.
I hope this clears up any confusion!
The filter option is no longer available, right? Or was it move somewhere different?
Could you give some more detail, Lina? Nothing's changed on our end.
Is there a way to monitors changes made to requesters' data?
Hi Team
Is there a way to add Account assumptions too as part of Audit log? information related to Granting account assumption, Support team logins and disabling the assumption?
Hi Nikita,
Changes related to the Account Assumption setting is already reflected in the Audit log, but it's a good catch on the logins that happen from Zendesk staff based on the assumption being granted. I've added a task to our backlog to investigate how we'd be able to present this. Thanks for your feedback.
I wanted to throw out some feedback on this:
For basic functionality the filtering is great if you know exactly what you are trying to find however, if you are trying to find a specific change the filtering that is provided doesn't help. It would be nice to be able to filter by each column or even keywords like a typical search uses. The reason I say this is because if someone changes a trigger or view, it would be easier to just use "View changed" or "trigger changed" to find something instead of having to comb though insignificant data.
I am aware that I can download this into a csv to filter it that way but really that shouldn't be necessary to find what Admins need.
Hi Megan,
Thanks for this feedback – would you mind upvoting and adding a comment with your use case to this product feedback thread? Overwhelmed by noise in audit log.
We need to be able to search the audit log by the user that was changed, not just the actor making the change. Is there a plan to implement this in the audit log or am I not seeing how to do this?
Can the audit log be set up as EXPLORE report query? It would be nice to be able to have Agent Log In times (for example) and have that an automated report sent to the Managers. Thank you
Khajik Khajadourian The user that was changed will be displayed in the Item column; there's no way to filter by this column at the moment but that work is being discussed and designed at the moment so it's something that we're actively working towards.
Fluke Corporation It's not on our short term roadmap but I do see the value in having the audit log be available in Explore for reporting purposes. Maybe some pre-canned dashboards too.
There is a mistake in the documentation (see paragraph below):
Tickets
The thing is that I just tested this and it is not possible to find "ticket field modification" in the audit log.
Hey Thomas, we should capture updates made to the ticket fields 🧐 Can you tell me which update you made that didn't show in the audit log for you and I can take a closer look?
Hi Caroline, so far I can 👀, the modification part isn't logged.
- I created a ticket field " Test" > Log ✅
- I changed the name of the ticket field "Test" into "Tes" > Log ❌ (This should be logged as I modified the field?)
- I deactivated the ticket field > Log ❌(I don't know if this should be logged?)
- I deleted the ticket field > Log ✅
Hi Thomas, thanks for that! Sorry I got confused between Ticket fields and Ticket forms; we did some recent work into Ticket forms which should capture creation, deletion, modification - but you're right that the same isn't true for Ticket fields. I'll remove the modification call-out for Ticket fields from this article and put a story on our backlog to close this gap. Thanks again and apologies for the incorrect info.
Hi Caroline,
thank you for this answer. Could you tell us whether there is another way to see the modifications done in ticket fields? (namely by whom?)
Thanks
Diana Kurth - if this is a one-off request and the changes occurred within the last 30 days, our Support team should be able to see this in logs. I recommend contacting support as documented here to have someone help with this: https://support.zendesk.com/hc/en-us/articles/4408843597850
Hi Dwight, thank you. This means indeed if changes <30 days you may see it.
But within an instance, even an admin cannot, right?
That's correct. Changes to ticket-fields are not included in the audit-log at this time.
https://support.zendesk.com/hc/en-us/articles/4408828001434/comments/4408849470746
I would like to port the audit log into a monitoring system to alert my team if certain changes occur. I don't see that anyone has asked this question just yet. I'm not asking for report or filtering. I'm asking if anyone has ever, or knows anything out there, that can access the logs.
We want teams to be alerted if "X" changes in the log, for example.
For example... are the logs available to a custom API? We are using Looker and we could use looker as a middle man on this if possible. IF so... where do I find the logs in the directory?
Any help is appreciated.
Please sign in to leave a comment.