The audit log shows various changes in your Zendesk since the account was created. It saves a record of these changes indefinitely, and you can view the entire change history. You can view the audit log in Admin Center, or via the Support API
This article contains the following sections:
About audit log changes
Specifically, the audit log shows the following changes.
- Account status
- Account billing cycle
- Account plan type
- Maximum number of agents for your account
- Subdomain name
User changes
- Agent and administrator creation and deletion
- Successful agent sign in
- Agent email address addition and deletion
- Agent added or deleted from group
- Agent role
- Agent and administrator password
- Group created
- Group deleted
- Organization deleted
- User suspensions
- Email address
- Twitter account
- Phone number
- Updates to a user's access settings
- Updates to a user's language
- Updates to a user's organization membership
- Updates to account-wide end user settings
- App installation, removal, settings modification, and activation
- App creation
- Added and removed from Help Center
- Answer Bot enabled and disabled
- Chat enabled and disabled
- Contact form enabled and disabled
- Contextual Help enabled and disabled
- Messaging enabled and disabled
- Show name field enabled and disabled
- Show on mobile enabled and disabled
- Talk enabled and disabled
- Ticket forms enabled and disabled
- Zendesk logo enabled and disabled
- Action color, channel name, contact form button text, conversation history, description, launcher text, message color, theme color, theme text color, title, position, and Web Widget button text changes
- Avatar updated and deleted
- Automation creation, deletion, modification, and activation
- Macro creation, deletion, modification, and activation
- Trigger creation, deletion, modification, and activation
- View creation, deletion, modification, and activation
- SLA policy creation, deletion
Tickets
- Ticket deletion
- Ticket form creation, deletion, modification
- Ticket field condition creation, deletion, modification
Settings
- API access settings changes
- Email archiving settings
- Global password policy
- IP Restriction setting changes
- Password policy changes
- Social media channel activation and deactivation
- Allowlist and blocklist additions, modifications, and deletions
- Team member authentication changes
- Updates to the domains
- Updates to the group
- Updates to the users value (shared ticket permission settings)
Information in the audit log includes:
| Column | Description |
|---|---|
| Time | Time and date the event occurred. |
| Actor | User who caused the event |
| IP address | IP address of the user who caused the event |
| Item | Object changed by the actor |
| Type | Type of action for the event (Created, Updated, Deleted, or Sign in) |
| Activity | Details about the event |
In the Zendesk API and Zendesk Support, audit log timestamps appear in Coordinated Universal Time (UTC). In Admin Center, audit log timestamps are based on browser locale.
Viewing the audit log in Admin Center
When you view the audit log in Admin Center, you can set a date range for the log entries you want to view, you can filter audit log entries, and you can export log entries in CSV format.
To view the audit log in Admin Center
- In Admin Center, click the Account icon (
) in the sidebar, then select Audit log > Audit log. - View the information in the audit log.
- Click the Time column to sort the entries by date.
- To filter the entries, click Filter, click Start date and End date to set a date range or enter a name in the Actor field to filter by the people or system responsible for the activities, and then click Apply filters.
By default, the filter date range is set to the last 12 weeks.
- To email yourself a copy of the audit log in CSV format, click Email CSV. If you filtered the list before clicking Email CSV, the file is also filtered this way.
When the export is complete, the email is sent to your primary Zendesk email address.
Personal information in the audit log
Administrators have the ability to permanently delete users, which removes the user from the system. This might be necessary because of General Data Protection Regulation (GDPR) or similar regulations, which grant individuals from certain regions the right to erasure or the right to be forgotten or deleted. When permanently deleting users and removing personally identifiable information (PII) from Zendesk products, you must consider whether the data captured in the audit log contains personal information that also needs to be removed.
This may be necessary, but it is important to understand that altering the audit log in this way can make it harder to accurately track your history.
- In Admin Center, click the Account icon () in the sidebar, then select Audit log > Audit log.
- In the page description, click Privacy settings.
- Select Automatically delete PII and click Save.
When this setting is enabled, personal information in the actor, IP address, and item columns of the audit log is deleted automatically when a user is permanently deleted. Names are replaced with user IDs.
22 Comments
Nice updates to add Date filtering. I'd love for filtering around what was changed like role edited for an agent or view activated/deactivated, etc.
I emailed a CSV to myself and it looks like it's using UTC time. Is there a way I can change that?
Hi Nick,
Thanks for reaching out. Timestamps can be displayed in different time zones across your Zendesk account, depending on your configuration.
However, the CSV export file that you can extract from this feature is in UTC.
For more information take a look at the link below:
https://support.zendesk.com/hc/en-us/articles/115000353048-Which-time-zone-does-Zendesk-use-
Hi,
Does the Maximum number of agents for your account under Account Changes include the count of Light Agents too or is it only agents who take up a license?
Also, is there any way I can check the total number of contracted licenses for an account through the API?
Thanks in advance.
Hey Ak,
Excellent question! Light agents will not count towards your max number of agents on the account.
I did some digging on my end and it doesn't look like there's an endpoint for contracted agent licenses currently. That being said, you could use the search users endpoint. In your search query, you will want to include the role ID for agents and admins on your account. This will at least allow you to pull a list of your agents who are using up a license on your Support account.
I hope this helps!
Hey Brett,
Thanks for the quick response.
I was just curious about what the Max agents in the audit log correspond to then? In the article above it is mentioned we can find out the Maximum number of agents for your account under the Account Changes in the audit log.
There is an entry in the audit log with the source_type:account and description:Max agents changed from X to Y. I was trying to understand what the definition of Max agent in this entry is.
Any information in this regard would be much appreciated.
Thanks!
Hey Ak,
That means the max number of agent licenses you have on the account. Not exactly how many of those seats you've filled up but how many agent seats you've purchased on your plan level.
Does that sound like what you're looking for?
Hey Brett,
Yes this is what I am looking for. My use case is to look at the total number of seats I have available on my plan, and to compare it with the total number of seats allocated to an agent(which I can get using the search user endpoint).
Thanks!
Hey Brett,
Just following up on the above comment again,
This mean that the Max agents number mentioned in the audit log here shows the number of licenses I have paid for right?
Apologies for opening this thread again, but I got this doubt when I was going through your reply again.
Thanks!
Hey Ak,
That's correct! Max Agents = the number of licenses you purchased on the account.
I hope this clears up any confusion!
The filter option is no longer available, right? Or was it move somewhere different?
Could you give some more detail, Lina? Nothing's changed on our end.
Is there a way to monitors changes made to requesters' data?
Hi Team
Is there a way to add Account assumptions too as part of Audit log? information related to Granting account assumption, Support team logins and disabling the assumption?
Hi Nikita,
Changes related to the Account Assumption setting is already reflected in the Audit log, but it's a good catch on the logins that happen from Zendesk staff based on the assumption being granted. I've added a task to our backlog to investigate how we'd be able to present this. Thanks for your feedback.
I wanted to throw out some feedback on this:
For basic functionality the filtering is great if you know exactly what you are trying to find however, if you are trying to find a specific change the filtering that is provided doesn't help. It would be nice to be able to filter by each column or even keywords like a typical search uses. The reason I say this is because if someone changes a trigger or view, it would be easier to just use "View changed" or "trigger changed" to find something instead of having to comb though insignificant data.
I am aware that I can download this into a csv to filter it that way but really that shouldn't be necessary to find what Admins need.
Hi Megan,
Thanks for this feedback – would you mind upvoting and adding a comment with your use case to this product feedback thread? Overwhelmed by noise in audit log.
We need to be able to search the audit log by the user that was changed, not just the actor making the change. Is there a plan to implement this in the audit log or am I not seeing how to do this?
Can the audit log be set up as EXPLORE report query? It would be nice to be able to have Agent Log In times (for example) and have that an automated report sent to the Managers. Thank you
Khajik Khajadourian The user that was changed will be displayed in the Item column; there's no way to filter by this column at the moment but that work is being discussed and designed at the moment so it's something that we're actively working towards.
Frank Florentine It's not on our short term roadmap but I do see the value in having the audit log be available in Explore for reporting purposes. Maybe some pre-canned dashboards too.
There is a mistake in the documentation (see paragraph below):
Tickets
The thing is that I just tested this and it is not possible to find "ticket field modification" in the audit log.
Hey Thomas, we should capture updates made to the ticket fields 🧐 Can you tell me which update you made that didn't show in the audit log for you and I can take a closer look?
Please sign in to leave a comment.