---
title: Audit log and activity
description: Read who did what: the unified activity timeline, admin actions, customer logins, VM events and sent e-mails, and how to search by event code.
url: https://nexcmp.com/docs/administration/audit-log/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# Audit log and activity

> **Where in the admin:** System › Logs › Activity (`/logs`), Admin actions (`/logs/admin`), Console (`/logs/console`), Login (`/logs/logins`), VM events (`/logs/vm-events`); Overview › Support › Sent emails.

NexCMP records every significant action. Use the **Activity** page as the single timeline, and the other tabs to narrow down.

## Tabs

| Tab | Content |
|---|---|
| **Activity** | Unified timeline across all sources: admin actions, VM events, logins, affiliate and system errors |
| **Admin actions** | What administrators changed (for example `customer.block`, `customer.delete`), with the administrator's IP |
| **Console** | Admin console sign-ins and system requests such as an update request |
| **Login** | Customer sign-ins and failures |
| **VM events** | Deploy steps, create, password, destroy and other lifecycle events per virtual machine |

## Reading a row

Columns: **Time**, **Source**, **Level**, **Actor** (who), **Target**, **Services**, **Action** (event code such as `customer.delete`) and **Details**. Click **Open** for the full record.

![The Activity page with source, site and service filters above the timeline](https://nexcmp.com/docs/images/administration/audit-log-01-activity.webp)

## Filter and search

1. Pick a **source**, **site** and **service** from the drop-downs.
2. Set a **From date** / **To date** range.
3. Type an event code (for example `customer.block` or `destroy`) in the search box — activity search matches the event code.

## Retention and exports

Records live in the NexCMP databases in `/var/lib/nexcmp` and are included in [backups](https://nexcmp.com/docs/getting-started/backup-and-restore/). Retention depends on the log: customer sign-in attempts older than 180 days and customer API-key request logs older than 60 days are cleaned up. Admin API-key audit keeps up to about 200,000 recent records. These limits do not imply the same retention for the unified activity timeline.

## Common uses

| Question | Where to look |
|---|---|
| Who suspended this customer? | Admin actions, search `customer.block` |
| Why did a VM disappear? | VM events, filter by the VM's ID; also Activity |
| Did the customer receive the e-mail? | Overview › Support › Sent emails |
| When was the last update requested? | Console tab |