The audit log shows various changes in your Zendesk account since the account was created. It saves a record of these changes indefinitely, and you can view the entire change history. You can view the audit log in Admin Center or via the Support API.
This article contains the following sections:
About the audit log changes
There are two key things to understand about the audit log: the types of changes captured and the details provided for each log entry.
Changes captured in the audit log
The audit log tracks changes that agents and admins have made to your Zendesk account. End user activities are not captured.
The audit log shows changes to the following areas:
- Account information and settings
- Users (updates to existing users only; activities related to creating new users are not captured)
- Apps
- Web Widget
- Business rules
- Ticket settings
- Organizations
- Custom objects
Audit log entries
For each entry in the audit log, the following information is included:
Column | Description |
---|---|
Time | Time and date the event occurred |
Actor | User or system that caused the event |
IP address | IP address of the user who caused the event |
Item | Object changed by the actor |
Activity type | Type of action for the event (Created, Updated, Deleted, Exported, or Signed in) |
Activity | Details about the event |
In the Zendesk API and Zendesk Support, audit log timestamps appear in Coordinated Universal Time (UTC). In Admin Center, audit log timestamps are shown in your account's time zone. See Setting your account's time. If you are unsure of what time the audit log is using, hover your mouse pointer over the information icon in the Time column heading.
Viewing the audit log in Admin Center
From the Audit Log page in Admin Center, you can view the audit log as a whole, sort the log by time, filter the list, or export a copy of the log.
- In Admin Center, click
Account in the sidebar, then select Audit log > Audit log.
Filtering the audit log
Often, only part of the picture is available when you visit the audit log. For example, you might know when something changed (but not what) or who changed something (but not when). Since the audit log can include a large volume of events, filtering makes it easier to find what you’re looking for.
While top audit events are available as filters, not all event types can be filtered. Additional audit events will be added over time.
To filter the audit log
- In Admin Center, click
Account in the sidebar, then select Audit log > Audit log.
- Click the Time column to sort the entries by date.
- To use more filters, click Filter.
Additional filters appear in a side drawer.
- To find entries within a specific date range, enter a Start date and End date.
-
Enter a name in the Actor field to filter by the people or systems responsible for the activities.
- Select an Activity type to filter entries by the action type (Created, Updated, Deleted, Exported, or Signed In).
- Use the filters in the Item section to filter by a specific
setting, user, or business rule that has changed.
- In the Type field, select or search the generic item type you want to filter by (for example, "Trigger").
- In the Names field, select or search for the specific items you want to filter by (for example, the trigger named "Notify assignee of comment update").
- Click Apply filters.
Exporting the audit log
You can export a CSV formatted copy of the audit log. If you filter the list before starting the export, the CSV file is also filtered this way. The exported copy is emailed to your primary Zendesk email address.
To export a copy of the audit log
- In Admin Center, click
Account in the sidebar, then select Audit log > Audit log.
- Filter the audit log as needed.
- Click Email CSV.
95 comments
Katie R.M.
Does the Audit Log show changes made to reports or dashboards in Explore?
We're preparing to train some new Editors and it would be helpful if we could see what they changed in a particular report or dashboard for troubleshooting purposes.
0
CJ Johnson
Katie R.M. It does not, you can upvote the feature request for it here though: https://support.zendesk.com/hc/en-us/community/posts/4408860640410-Explore-Audit-Log-with-list-of-changes
0
Jacob Hill
Hello! Is there a way to offload the audit logs to a SIEM, specifically Azure Sentinel?
0
Gabriele Biella
Hi,
I'm using the Audits API to fetch some data from the "history".
But, when a ticket is created from the WhatsApp channel the "history" field is empty.
I expected to find at least the first message from the customer who contacted the helpcenter via WhatsApp.
It seems that the conversation data is added to the history only after the agent modifies the ticket, is correct? is this the correct behavior?
Thanks
0
Andrew Lundy
I don't see the Audit Log option anywhere in Zendesk Admin. (I am the account owner).
0
Dwight Bussman
HeyO Andrew Lundy - that option will only appear in accounts on our Enterprise plan. If your account has that plan-level and you're still not seeing it, please contact support to look into that more closely.
0
Kim Dickey
I see that the audit log tracks when a help center is *deactivated* but not when it is activated, which is the information I'm trying to find out. Is there any way to track down this information or am I missing it as an event not tracked under the "Brand" type?
0
Max McCal
Kim Dickey – Guide events are something we're focussed on this year. While we don't currently track Help Center activations and deactivations, you will start to see them in Q2 of this year.
0
Jake Warren
Hi Dwight Bussman,
I'm having trouble getting the results that I expect. Can you help me understand how I would filter to see any and all history for a specific end user? I want to see when it was created and by who, as well as any future updates/changes and by who (and when of course). I'm not able to get this.
Thanks,
Jake
0
Viktor Osetrov
At this moment we have the option to check the activity timeline for specific users.
Please follow for that -> Announcing the new Customer Profile Page and Activity Timeline open beta
If it's not enough please feel free to create a ticket with us.
Thank you
0
Nobuhiro Kobayashi
Does the audit log exclude Zendesk Explore activities?
0
Joyce
Explore changes are not captured in Audit logs. I've taken a look and found that other users are discussing similar needs here: Explore - Audit Log with list of changes
You can up-vote that original post and add your detailed use-case to the conversation. Threads with a high level of engagement ultimately get flagged for product managers to review when they go through roadmap planning.
0
Jasper Gonzales
What filters should be used when looking up for suspended agents?
0
Dwight Bussman
Jasper Gonzales
If you're looking to see changes to team members in logs, you can search for Activity of "Updated" with a Type of "Team member"
![](/hc/user_images/01HB9DNVM99Z02YGJMA8VA77GC.png)
If you want to get a list of any agents/admins within your account who are currently suspended, you can use the normal search with parameters like this:
0
Roy Landman
Caroline Kello Am I correct in stating changes to an end user in their language are not captures in the Audit log? Knowing this would really be helpful because the end users language does or can be determining for routing or the offering of dynamic content. The article only states that changes in users are captured (and most changes are) but language doesn't seem to be.
0
Sam
Are there any audit logs associated with updates made to the OOB Salesforce <> ZD integration settings? i.e. Ticket View, Data Sync, Support app ?
0
Jupete Manitas
Note: Tickets that are created or modified in Salesforce are not included in the integrations log.
We hope this will suffice at the moment.
0
Ryan Winkler
Hey Sam,
Is the integration logs sufficient for what you're looking for? I'm interested in knowing more of your needs surrounding logging around this.
I'd love to hear more about what's missing!
0
Jiri Fait
Please do enrich the filter options. Plus it would be more than nice to be able to filter it by product (Support, Guide, Gather, and especially Sell) - Sell has no audit log, it would be very nice to trace back who made certain changes.
0
jvon
Are bulk deletion actions expected to be in the audit log? We have a workflow which involves deleting duplicate tickets (long story....) while we see some tickets that are manually deleted one-by-one - we do not see tickets that are bulk deleted.
0
Ivan Miquiabas
Thanks for reaching out! Bulk deletion entries will show on Audit logs as one-by-one per ticket deletion as well not by bulk.
0
jvon
So - there's probably an opportunity for enhancement here with the Activity Type filters.
I was able to find the activity in the audit log -- the Activity Type displays as "Permanently Deleted" (capture.png)
However - the filters don't have "permanently deleted" as an option, only deleted. (capture2.png)
Also - kind of weird for this to reference my account name within the assigned organization and not my community name - not sure if that placeholder can be updated :)
0
Ivan Miquiabas
I believe yes, this can be submitted as a product feedback. I would suggest this to our product team, but if you do have spare time, you write them a feedback directly.
With regards to your Community name, not sure if that is associated with a placeholder, but here is an article to change it. Hope that helps!
Cheers!
0
Matt Taylor
Is there a way to exclude specific actors from the log? I'd like to remove an API actor, as well as an admin from the audit log so that I can identify users who may mistakenly make changes and look at education them.
Thank you as always :)
0
Ivan Miquiabas
Good day! I don't think there is a way to completely remove other actors such as API and admin on the list, but you can always utilize filters to easily find what you are looking for. Just make sure you do know specific timestamps or actor to at least ease your way on finding a specific log.
Hope that helps!
0
Hannah Lucid
Is there a way to schedule the audit log to send to email via CSV/EXL? We'd like to be able to schedule the audit log to send a log of the past x day/weeks/months.
0
Monica
Scheduling with filtering so it alerts based on concering changes would be beneficial.
0
Ryan Winkler
Hey Matt! No exclusions possible at the moment, but I have that logged as a proper feature request, and definitely see the need.
No ETA or priority on that at the moment, but I can say that explicit feedback like yours helps a lot with prioritization, so keep them coming! We're listenting :)
0
Ryan Winkler
At the moment we do not have any sort of scheduling or alerting of any kind in product for Audit logs. We generally advise to export to your data warehouse or tooling which can alert and action from the API itself
However, that doesn't really help in terms of ease of use or general needs when you don't have that, or need a user friendly option, and I can definitely see how both of those could be useful.
Hannah Lucid – For the export for the csv/file, what do you use to review that from there? Do you upload the file to your analytics tool or some application to read that or are you just reviewing the file directly? Is the CSV/XML export out of convienance or is that the ideal output?
I'm curious on the full journey here, for sure
@monica — For alerting – What is your ideal outcome? Email? Webhook (3rd party integration alert) or something else? Curious to know your thoughts here — Is there anything specific or higher priority to alert on than anything else? What would you denote as a concerning change?
Thanks, both of you, for the feedback and thoughts!
0
Hannah Lucid
For the export for the csv/file, what do you use to review that from there? Do you upload the file to your analytics tool or some application to read that or are you just reviewing the file directly?
We would review the file directly. An excel export would be ideal in this scenario since it would be easier to read.
Is the CSV/XML export out of convienance or is that the ideal output?
Convenience, but also ideal. We have three different instances of Zendesk, so having separate files could/would be beneficial.
Also, as many other have noted, the audit log doesn't include all adds, deletions, modification, etc. events that happen. Things that aren't applicable to many admins, such as agent logs ins, are clearly listed out, but things like form field condition modification/deletion is not included/clear. Having a clear audit log would be *chefs kiss*.
Thank you!
0