# Audit and diagnostics - Link: https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/audit-and-diagnostics/ - Published: 2026-08-24T01:47:05+00:00 - Author: Don Bowman 1. [Home](https://www.agilicus.com/) 2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/) 3. [Concepts](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/) 4. Audit and diagnostics ![1a819e2b-featured-anyx-admin-conceptsaudit-and-diagnostics](https://www.agilicus. com/www/1a819e2b-featured-anyx-admin-conceptsaudit-and-diagnostics.png) ## Audit and diagnostics [CONTACT](https://www.agilicus.com/contact-us/) Agilicus AnyX records what happens on your platform so you can answer the questions that matter for security and compliance: _who accessed what, when, from where, and was it allowed?_ Audit data and diagnostics are separate concerns with different screens, and this page explains both. ## What is recorded Every significant event is recorded: * **Authentication events**: sign-in attempts, successes, failures, and multi-factor authentication events. See [Authentication audit](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/). * **Authorisation decisions**: who was allowed or denied access to which resource, and why (for example a policy rule). See [Access audits](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/access/audits/). * **Sessions**: active and historical user sessions, including token-based sessions. See [Sessions](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sessions/). * **Resource activity**: requests made through a resource, including HTTP requests. See [Application diagnose](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/applications/) and [Metrics](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/metrics/overview/). ```wp-block-agilicus-mermaid %%{init: {"theme": "base", "themeVariables": {"background": "#ffffff", "primaryColor": "#e8f1fb", "primaryBorderColor": "#1f4e79", "primaryTextColor": "#111111", "lineColor": "#4a4a4a", "secondaryColor": "#f5f5f5", "fontFamily": "Inter, sans-serif"}} }%% flowchart LR AUTH[Authentication events] AUTHZ[Authorisation decisions] SESS[Sessions] RES[Resource activity] AUTH --> AUD[Audit subsystem] AUTHZ --> AUD SESS --> AUD RES --> AUD AUD --> DEST[Audit destinations] AUD --> VIEW[Portal views and searches] DEST --> SIEM[SIEM / log service] ``` ## The audit subsystem The **audit subsystem** is the engine that collects and stores audit events. The portal’s [Audit subsystem](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/audit-subsystem/) page shows the health and statistics of this engine. ## Audit destinations Audit events can be **forwarded** to destinations outside the portal, for example a SIEM service. This keeps a copy of your audit trail in your own logging pipeline and lets you correlate with other sources. See [Audit destinations](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/audit-destinations/) and the web guide’s [SIEM event forwarding](https://www.agilicus.com/siem-event-forwarding). The recommended pattern for sending logs to a SIEM is to consume logs locally, convert them to a secure format (JSON over HTTPS), and forward them through an outbound- only connector. Raw, unencrypted protocols must never be routed directly to the internet. See [Sending logs to a SIEM target](https://www.agilicus.com/sending-logs-to-a-siem-target). ## Diagnostics **Diagnostics** are the read-only views and counters that help you troubleshoot. They are deliberately separate from configuration: * **Application diagnose**: inspect a live application’s requests, headers, and responses to see exactly what a user or a service is sending and receiving. See [Applications](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/applications/). * **Connector diagnostics**: connector health counters (connection state, throughput, errors). See [Connectors](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/). * **Authentication audit**: search and review sign-in events for a user, including failures. * **User audits**: review everything a specific user has done. * **Metrics**: aggregated usage such as top users and active users. See [Metrics](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/metrics/overview/). ```wp-block-agilicus-mermaid %%{init: {"theme": "base", "themeVariables": {"background": "#ffffff", "primaryColor": "#e8f1fb", "primaryBorderColor": "#1f4e79", "primaryTextColor": "#111111", "lineColor": "#4a4a4a", "secondaryColor": "#f5f5f5", "fontFamily": "Inter, sans-serif"}} }%% flowchart TD D[Diagnostics] D --> A[Application diagnose] D --> C[Connector counters] D --> AU[Authentication audit] D --> UA[User audits] D --> M[Metrics] ``` ## Using audit for troubleshooting A common troubleshooting pattern: 1. Ask the user what they were doing (which resource, which time). 2. Open the [authentication audit](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/) to confirm they signed in. 3. Open [user audits](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/access/audits/) to see whether access was allowed or denied and why. 4. Open [application diagnose](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/applications/) or connector diagnostics to inspect the traffic level. 5. Review [sessions](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sessions/) to see active sessions. Each screen explains how to search, filter, and page through the results. ## See also * [Authentication audit](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/) * [Audit subsystem](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/audit-subsystem/) * [Audit destinations](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/audit-destinations/) * [Sessions](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sessions/) * [Access audits](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/access/audits/) * [Metrics](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/metrics/overview/) ## Web guide * [Audit destinations](https://www.agilicus.com/product-guide/audit-destination) * [SIEM event forwarding](https://www.agilicus.com/siem-event-forwarding) * [Zero trust audit logging](https://www.agilicus.com/zero-trust-audit) * [Sending logs to a SIEM target](https://www.agilicus.com/sending-logs-to-a-siem-target) * [Authentication audit](https://www.agilicus.com/product-guide/authentication-audit)