# Audit subsystem

1. [Home](https://www.agilicus.com/)
2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/)
3. [Organisation](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/)
4. Audit subsystem

![](https://www.agilicus.com/www/6699608a-featured-anyx-admin-organisationaudit-subsystem.png)## Audit subsystem

[CONTACT](/contact-us/)

The **Audit Subsystem** page (route `/audit-subsystem`) records the API and configuration activity of your organisation: who modified what, when. It is the audit trail of changes made to the organisation itself.

![Audit subsystem overview](https://www.agilicus.com/www/9657ae7e-audit-subsystem-overview.png)    ## Purpose

While the [Authentication audit](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/) records sign-in events, the audit subsystem records changes to the organisation's objects: creating or updating resources, changing users and metadata, revoking tokens, and so on. Each record answers the question *who modified what, when*. Use this screen to understand the changes made to your organisation, when those changes happened, and who made them.

The audit subsystem is the engine that collects and stores these events; see [Audit and diagnostics](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/audit-and-diagnostics/).

## Why use it

- Review what changed in the organisation over a time window.
- Find out who created, updated, or deleted a resource or user.
- Trace when a change happened, for example to correlate with an incident.
- Search by connector to see activity behind a specific connector.
- Export the records for compliance or analysis.

## When to use it

- When investigating an unexpected change to a resource or user.
- When you need an answer to *who did what and when* for a security review.
- When correlating activity with the [Authentication audit](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/) and [Sessions](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sessions/).

**Prerequisite**: read permission for the audit subsystem. The page shows a *no permissions* message otherwise.

## How to use it

1. Open **Organisation > Audit Subsystem** from the left navigation.
2. The screen loads the records for the **past seven days** by default.
3. To change the window, set **Start Time** and **End Time** with the date pickers.
4. Select **VIEW AUDITS** to reload the table.
5. Page through the results with the paginator.
6. Use the filter menu to narrow by **Connector** if you have connectors.
7. Select **DOWNLOAD AUDITS** to export the current results.

## Fields and controls reference

| Field or control | Purpose | Required | Default | Valid values | Notes |
|---|---|---|---|---|---|
| Start Time | Beginning of the audit window | Yes | Seven days ago | A date and time |  |
| End Time | End of the audit window | Yes | Now | A date and time |  |
| VIEW AUDITS | Loads the records for the chosen window | n/a | n/a | n/a |  |
| DOWNLOAD AUDITS | Exports the current results as CSV | n/a | n/a | n/a |  |
| Filter | Narrow the table by Connector | No | None | Connector names | Use the filter menu and type-ahead search |

### Table columns

| Column | Meaning |
|---|---|
| Timestamp | When the change happened |
| Type | The kind of object that changed (for example `orgs`, `application<em>services</em>`, `usermetadata`, `tokens`) |
| Resource | The name or identifier of the object |
| Action | What happened (for example Create, Update, Delete, Revoke, Introspect) |
| Email | The person (or service) who made the change |

## Dialogs and popups

There are no configuration dialogs on this screen. It is a search and review interface.

## Configuration versus diagnostics versus confirmation

- **Configuration**: none. This screen only reads audit records.
- **Diagnostics**: the whole screen is diagnostic: a searchable, filterable, exportable change log.
- **Confirmation**: none. There are no destructive actions.

## Pagination and async behaviour

- The table pages at **25 rows per page** and fetches a window of pages at once, so the paginator shows several page numbers even when the current result set is small. Use the page numbers to move through the results.

![Audit subsystem page two](https://www.agilicus.com/www/9657ae7e-audit-subsystem-page2.png)    - Records load asynchronously after selecting **VIEW AUDITS**. When a page contains no further records (for example at the end of the data), the table shows that page empty; return to an earlier page to continue.

## Troubleshooting

- **The table is empty**: the default window is the past seven days. Widen the range with **Start Time** and reload.
- **A page shows no rows**: you have reached the end of the available records; the paginator returns to the first page.
- **I cannot see changes made by an administrator in a sub-organisation**: switch to that sub-organisation with the organisation switcher and review its own audit subsystem, or use the [Sub-organisations](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sub-organisations/) overview.

## See also

- [Audit and diagnostics](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/audit-and-diagnostics/)
- [Authentication audit](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/)
- [Sessions](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sessions/)
- [Audit destinations](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/audit-destinations/)
- [Getting started: audit a user](/anyx-guide/agilicus-anyx-administrative-web-interface/getting-started/audit-user/)

## Web guide

- [Zero trust audit logging](https://www.agilicus.com/zero-trust-audit)
- [Diagnosing user issues with audits](https://www.agilicus.com/diagnosing-user-issues-with-audits)
- [Authentication audit](https://www.agilicus.com/product-guide/authentication-audit)