---
title: "Audit Log Function"
slug: "about-audit-log"
updated: 2024-09-10T11:26:18Z
published: 2024-09-10T11:26:18Z
canonical: "documents.trocco.io/about-audit-log"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://documents.trocco.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log Function

Help page about the audit log function.

## summary

Audit logs are log data that record "who," "when," and "what" actions were taken on the system. It is mainly used to perform system audits. TROCCO's Audit Log feature records TROCCO users' actions and provides the recorded audit logs in a CSV file.

              Plan Restrictions

              

Audit logs are available only for accounts subscribed to the **Advanced** plan or higher.

## precautions

              Audit log retention period and audit log acquisition start date

              

- The audit log function allows the user to review audit logs for **the past year**.
  - Audit log data recorded prior to the past year will be deleted sequentially and cannot be checked.
- The audit log function will begin recording audit logs from the date you subscribe to the audit log function.
  - Audit logs for users performed while not subscribed to the audit log function are not recorded and cannot be checked.

## Audit Log File Specifications

Audit logs can be downloaded as CSV files. Below are the specifications of the CSV file to be downloaded.

### List of columns in CSV file

The CSV file of the audit log consists of the following columns

| column name | Value Description |
| --- | --- |
| `User ID` | The ID of the user who performed the action. **The value is guaranteed to be unique for each user.** It is automatically set when a user is invited to TROCCO and will not be changed thereafter. |
| `Email` | The email address of the user who performed the action. **Email addresses are subject to change.** |
| `IP Address` | The IP address of the user who performed the action. |
| `User Agent` | The OS and browser used by the user who performed the action, and its version. |
| `Role` | The permissions on the TROCCO account of the user who performed the action. It can be one of the following values`Account Super Admin``Account Admin``Account Member` For details, please refer to [what can be done with each user's privileges](/docs/account-roles). |
| `Available Features` | This is a TROCCO feature available to users who have performed the action. Depending on the functions available to the user in question, the following values are included`Basic` Features: TROCCO's basic features`Data Catalog`Audit `Log`: Audit Log For more information, see [Functions.](/docs/user-settings#%E6%A9%9F%E8%83%BD%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6) |
| `Restricted Features` | The user who performed the action is prohibited from using this feature of TROCCO. Depending on the function forbidden to the user in question, the following values are included`Connection Modification`: Creation, Editing, and Deletion of Connection Configuration For more information, see [Functions.](/docs/user-settings#%E6%A9%9F%E8%83%BD%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6) |
| `Category` | The name of the TROCCO function that was the subject of the action. For more information, see [the categories](/docs/about-audit-log#%E3%82%AB%E3%83%86%E3%82%B4%E3%83%AA%E3%83%BC) below. |
| `Action` | Action Summary. See [actions](/docs/about-audit-log#%E3%82%A2%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3) below for more information. |
| `Action Details` | Additional information about the action. |
| `Date and Time (TIMEZONE)` | The date and time when the user performed the action. The time zone selected when [downloading the audit log file](/docs/about-audit-log#%E7%9B%A3%E6%9F%BB%E3%83%AD%E3%82%B0%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89) is included in the column name. Note that if you select `Asia/Tokyo` as the time zone, actions taken `at 12:00:00` UTC will be converted to `21:00:00` UTC and output. |

              Identifier

              

See `User ID` as an identifier to identify a user. `Email` cannot be referenced as an identifier because it may change during the process.

### category

The category (Category) has as its value the name of the TROCCO function that was the target of the action. The values included in the categories are as follows

              Functions not included in the category list

              

Actions logged for functions not included in the list of categories below will not be captured.

| Category Name | Contents |
| --- | --- |
| `ETLConfiguration` | ETL Configuration |
| `ETLJob` | ETL Job |
| `ManagedETLConfiguration` | Managed ETL Configuration |
| `DataMartDefinition` | Data Mart Configuration |
| `DataMartJob` | data mart job |
| `DbtGitRepository` | dbt Git repository |
| `DbtJobConfiguration` | dbt Job Setting |
| `DbtJob` | dbt job |
| `Team` | team |
| `ResourceGroup` | Resource Group |
| `ResourceGroupRole` | Roles (permission settings) for Resource Groups |
| `WorkflowDefinition` | Workflow |
| `WorkflowJob` | Workflow Job |
| `ConnectionConfiguration` | Connection Configuration |
| `Notification` | Notification to |
| `Label` | Label |
| `Account` | TROCCO Account * This action affects all users belonging to the TROCCO account. |
| `User` | TROCCO Users * Actions that affect only each TROCCO user himself/herself. |
| `APIKey` | TROCCO API |
| `AuditLog` | audit log |
| `Page` | Access to TROCCO * Log each time a page on TROCCO is accessed. |

### action

In Action, the action name is taken as the value. Each action includes a category name as a prefix. For a list of actions and their details, please refer to the following csv file.

[audit_log_action_list.csv](https://cdn.document360.io/3a3bae1e-f157-487f-8798-01e9d820e760/Images/Documentation/audit_log_action_list.csv)

## Procedures for Using Audit Logs

### initialization

To use the audit log, user permissions must be set in advance. For more information, see [User Permission Settings](/docs/user-settings).

## Download Audit Log File

1. Click on **Audit Log Output** in the left sidebar
2. Select the time period and time zone for the retrieval, then click **Output**. ![005-p.png](https://cdn.document360.io/3a3bae1e-f157-487f-8798-01e9d820e760/Images/Documentation/about-audit-log-2024-08-29-1-54-0.png) Preparation for downloading will begin. Please wait a moment.
3. Click to **download** ![006-p.png](https://cdn.document360.io/3a3bae1e-f157-487f-8798-01e9d820e760/Images/Documentation/about-audit-log-2024-08-29-1-54-1.png) A ZIP file will be downloaded. The ZIP file contains CSV files separated by month.

              Supplemental information on downloading audit logs

              

- Audit logs should be downloaded **within 24 hours of output**.
  - After 24 hours of output, downloading will no longer be possible.
- **Only the audit logs output by the company itself** can be downloaded.
  - Audit logs output by other users cannot be downloaded.
- The date and time displayed in the Output History > Output Date and Time column is based on `Asia/Tokyo` (Japan Standard Time).

## Change history of the audit log function

| Date of change | Change Summary | Change Details |
| --- | --- | --- |
| 2023/04/10 | Release of audit log function | - |
| 2023/05/10 | Time zone can now be specified for audit log output | Time zone can now be specified for audit log output. For more information, see `the Date and Time (TIMEZONE) row in`[the CSV file column list](/docs/en/about-audit-log#CSV%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E3%82%AB%E3%83%A9%E3%83%A0%E4%B8%80%E8%A6%A7). |
| 2023/05/10 | Update [audit_log_action_list.csv](/docs/en/about-audit-log#%E3%82%A2%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3) | Along with the change of the function name **from two-step authentication****to two-factor authentication**, the wording of the description of the following actions has also been changed.`UserTwoFactorAuthenticationEnabled`,Enable two-factor authentication`UserTwoFactorAuthenticationDisabled`,Disable two-factor authentication |
| 2023/09/06 | Addition of actions to be acquired and update [audit_log_action_list.csv](/docs/en/about-audit-log#%E3%82%A2%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3) | Actions to be retrieved have been added with the addition of the [time zone setting](/docs/time-zone).`UserUpdatedForTimeZone`,UserUpdated (change time zone setting) |
| 2023/09/14 | Change or add `Role` column values | The values in the `Role` column were also changed and added along with the change in the TROCCO authority name and the addition of the new authority.`Account Super Admin`: value added with the addition of a new privilege, [Account Privileged Admin.](/docs/about-super-admin)`Account Admin`: changed from `old` admin`Account Member`: Changed from `old` member For details, see the `Role` row in [the column list of the CSV file](/docs/en/about-audit-log#CSV%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E3%82%AB%E3%83%A9%E3%83%A0%E4%B8%80%E8%A6%A7). |
| 2023/10/12 | Add `Restricted Features` column | Added `Restricted Features` column to [User Permissions > Prohibited Features](/docs/user-settings#%E7%A6%81%E6%AD%A2%E3%81%99%E3%82%8B%E6%A9%9F%E8%83%BD). For details, see the `Restricted Features` row in [the column list of the CSV file](/docs/en/about-audit-log#CSV%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E3%82%AB%E3%83%A9%E3%83%A0%E4%B8%80%E8%A6%A7). |
| 2024/03/05 | Deletion of actions to be acquired and update [audit_log_action_list.csv](/docs/en/about-audit-log#%E3%82%A2%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3) | Deleted actions to be retrieved.`ETLConfigurationUpdatedFromPastRevision`, `ETL Configuration` Update (restore past revision of changelog) |
| 2024/04/02 | Addition of actions to be acquired and update [audit_log_action_list.csv](/docs/en/about-audit-log#%E3%82%A2%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3) | Actions to be retrieved have been added to accommodate changes in [organization names](/docs/organization-name).`AccountOrganizationNameUpdated`,OrganizationNameUpdated |
| 2024/05/20 | Update [audit_log_action_list.csv](/docs/en/about-audit-log#%E3%82%A2%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3) | Added an action when manipulating a Data Mart Configuration using the [trocco API](/docs/trocco-api).`Data Mart DefinitionCreatedFromAPI`,Creation of Data Mart Configuration (created using API)`Data Mart DefinitionUpdatedFromAPI`,Updating Data Mart Configuration (using API)`Data Mart DefinitionDeletedFromAPI`,Deletion of Data Mart Configuration (using API) |

              2024/03/05 `ETLConfigurationUpdatedFromPastRevision` action removed

              

The `ETL ConfigurationUpdatedFromPastRevision` was specified to be retrieved when a **restore was** clicked from the Revision Details screen in `ETL` Configuration. On the other hand, past revisions are actually restored when they are **saved and applied** on the Edit ETL Configuration screen that appears after the **restore is** clicked. As mentioned above, we decided to remove this action because the timing at which `ETLConfigurationUpdatedFromPastRevision` is retrieved and the timing at which past revisions are actually restored are different.