Full traceability of all administrative actions on the platform
Detecting unauthorized access or failed login attempts
Auditing configuration changes, course creation, role assignments, and collaborator management
Exporting records for security reviews or compliance requirements
Filtering events by user, action type, or time period for specific investigations
Navigation: Settings → Audit Log
Go to Settings from the left sidebar.
Select Audit Log. The table displays the most recent events (default: last 7 days).
Each row in the table includes:
User: who performed the action (a user or "System" for automated events)
Action type: type of event, shown as a color-coded badge
Affected object: the element affected by the action (e.g., course name, collaborator email)
Timestamp (UTC): exact date and time of the event in UTC
Filter by user
Use the Search field to search by username or email. The filter is applied as you type and appears as an active chip below the search bar.
To clear the filter, click the ✕ on the chip or delete the text from the field.
Filter by action type
Click Action Type to open the dropdown with all available event type
If you select an invalid filter combination, the platform displays the error: "The selected action is invalid." Review the active filters and adjust your selection.
Filter by time period
Click the period selector (default: Last 7 Days). Available options are:
Last 7 days
Last 30 days
Last 90 days
When a period is selected, the date range appears as an active chip (e.g., Mar 17 – Jun 15).
Export
Click the download icon (↓) in the top right corner of the table to download the log as a CSV file. The file respects the filters currently active.
The tooltip on hover shows: "Download CSV".
Pagination
The table shows 10 rows by default. You can change the row count (Rows per page) and navigate between pages using the arrows.
Who can see the Audit Log?
Only administrators with access to Settings. Regular collaborators do not have access to this section.
What does "System" mean in the User column?
It means the action was generated automatically by the platform, not by a human user. The most common case is failed login attempts (Login Failed).
Are timestamps in my local timezone?
No. All timestamps are displayed in UTC. Keep that in mind when correlating events with local times.
Can I combine user, action type, and period filters?
Yes. All three filters can be combined and are applied simultaneously. Active filters are always visible as chips below the search bar.
Does the CSV include only the filtered events or all records?
The CSV respects the filters applied at the time of download. If no filters are active, it exports all events within the selected time period.
Do you have feedback or want to request improvements? Let us know at roadmap.whalemate.com/roadmap
