Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/partner/help/en-us/index.html?contextId=logs-audit

Audit Logs

You can export reports of actions carried out in Sophos Central Partner and actions by customers managed from Sophos Central Partner.

Note

Your admin role affects what you see in the Audit log. If you don't have access to a customer, you don't see that customer's actions.

To find the Audit Log reports, go to the Logs page.

All activities for the past 7 days are shown in the Audit Log by default. You can view all activities for up to 90 days. You can export an Audit Log report containing a record of all activities in the last 90 days.

The Audit Log lists the following for each activity:

  • Date: Date and time when the activity or change occurred.
  • Event Location: Where the event occurred. This could be Sophos Central Partner or one of the customers.
  • Modified by: The Sophos Central Partner account that made the change or signed in.
  • Item type: The type of activity or change. For example Users and Groups were changed.
  • Item modified: What was added, changed or deleted. For example the name of a new user that was added.
  • Description: More details about the activity or change. For example a successful authentication by a Sophos Central Admin account.
  • IP address: The IP address from where the activity or change was carried out.

Filter

You can filter the Audit Log by date range, event locations and by search results. You must click Update to apply the filters.

  • Date: Use this option to set the date range for the activities you want to view. You can select any date within the last 90 days. The date range works with the Search field and the Audit Log shows the items related to your selected date range and search term. If you do not enter a search term or filter, the Audit Log shows all activities for your selected date range.
  • Event locations: You can filter results by All event locations or Partner only.

There is a limited search available. The Audit Log shows the items related to your search term and the selected date range. If you do not set a date range the Audit Log shows the items related to your search term for the last 7 days, by default. You can search by:

  • Customer: Shows all changes and activity made from a specific customer over the selected date range.
  • IP address: Shows all changes and activity from an IP address over the selected date range.
  • Modified by: Shows all changes and actions made by a Sophos Central Partner Admin account over the selected date range.

Export

You can export an Audit Log report that contains a record of activities for a selected date range or the last 90 days. You can filter the Audit Log before exporting. Search filtering applies to all export options. The date range does not.

To export an audit report:

  1. Filter the Audit Log, if required. Select Update to apply the filters to the Audit Log.

  2. Click Export on the right-hand side of the Audit Log page and choose an option from the drop-down list.

    • CSV of current view or PDF of current view: Exports the current view as a comma separated file or as a PDF file. If you select one of these options all currently selected filters are applied to the exported file.
    • CSV of past 90 days or PDF of past 90 days: Exports activities from the past 90 days as a comma separated file or as a PDF file. If you select one of these options only search filtering is applied to the exported file.

  3. Review the audit report to check that it contains the information you require.

  4. Change the audit report name.

Audit reports are exported as audit.csv or audit.pdf.