Activity log
The Activity log captures workspace-level events that don’t belong to the Events group — sign-ins, IAM changes, setting updates, and other administrative actions. It comes with a timeline chart on top so you can spot bursts of activity at a glance, and a detailed list below.
This page is administrator-only.
How to get here
Open the sidebar and go to Audit → Governance → Activity log. Only administrators see this group.
What’s in the list
| Column | What it shows |
|---|---|
| User | The user who performed the action |
| Time | When the action happened |
| IP address | The IP address the action came from |
| Action | What the user did (sign in, change a setting, connect to a server, etc.) |
| Result | The outcome, shown as an HTTP-style status |
| Details | A short summary of the action |
Click the expand icon on any row to see the full detail for that activity.
For alert rule and per-server override updates, the full detail also shows each changed field twice: a struck-through Before line, then an After line—so changed fields show the value before and after that update. A record with no stored before-image looks as it always has, with only the current value.
Choosing a time range
Pick a range above the timeline chart, or set your own start and end dates. Clicking a bar narrows the list below to that bucket until you change the range again.
This page is an Essentials-and-above feature. The date picker reaches back 120 days on Essentials and 365 days on Enterprise. That is how far this screen queries, not how long the records are kept. Only the ranges that fit inside it are offered: Essentials stops at the last 3 months, Enterprise adds the last year.
Reading activity through the API
The activity log is also available through the API, MCP, and the CLI (alpacon audit). There, reading anything beyond your own activity requires the activity:read permission across the workspace, which administrators and auditors have. Without it, every request returns only your own records whatever filters it sends, and a request filtered by group (?group=) is refused with 403.
What kinds of activity show up here
- Authentication — sign-in, sign-out, failed sign-in attempts, session management.
- Server operations — server connections, configuration changes, server-level admin actions.
- Workspace operations — settings modifications, member invitations, permission changes.
- File operations — WebFTP uploads and downloads, file permission changes.
Common things you’d check here
- Security monitoring — spot unusual sign-in patterns. Track repeated failed authentication attempts. Review privileged actions.
- Compliance — keep an audit trail of administrative changes for regulatory reviews.
- Operations — review usage patterns. Identify users who might need training. Track workspace utilization.