---
title: "Audit Log"
description: "Everything Asphyxia and your staff have done, in one filterable timeline."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.asphyxia.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log

The audit log is the complete record: every detection, every connection, every
admin action, every system event.

## Entry types

| Type | Records |
| :--- | :--- |
| Connection | Players joining |
| Disconnect | Players leaving, with the reason and session length |
| Detection | A detection firing |
| Admin action | Something a staff member did |
| Config | Configuration changes and identifier changes |
| System | Startup, shutdown and internal events |

## Severity

**Info** is routine. **Warning** is worth noticing. **Critical** needs
attention now — a ban, a failed integrity check, an admin doing something
unusual.

Filtering to critical is a reasonable daily habit.

## Admin accountability

Every staff action is logged with the name of the admin who took it: bans,
unbans, notes, resolved strikes, screenshots, whitelists, entity deletions,
promotions.

That's the point. Moderation tools are easy to abuse, and an audit trail is
what makes abuse visible. If an admin bans someone they shouldn't have, or
takes screenshots of a player they have a grudge against, it's here.

## Identifier changes

When a returning player's identifiers don't match what Asphyxia stored, that's
logged as a config warning with exactly what changed.

Usually it's innocent — someone linked a Steam account, or their IP changed.
Sometimes it's someone trying to shed an identifier that's tied to a ban.
Repeated changes on one account are worth a look.

## Retention

Old entries are pruned according to **Log Retention** on
[Configuration](/website/configuration). Setting it to `0` keeps everything
forever, at the cost of a table that grows without limit.

## Filtering

Search matches type, severity, player name and message. Combine it with the
type and severity filters to narrow an investigation quickly — for example,
admin actions at critical severity is a short and interesting list.

Source: https://docs.asphyxia.dev/website/logs/index.mdx