Audit Log & Support Diagnostics¶
Audit log¶
The console's cluster log records every sign-in, admin change and task outcome. That includes changes to users, roles, tenants and API keys, password and MFA resets, and every console setting: Require MFA, LDAP and single sign-on and their group mappings, cloud backup, TrueNAS, OVN, the AI assistant, the license, registry credentials, configuration import, the console name and URL, and Enable HA.
Settings → Audit Log has two controls:
- Keep for sets how many days the console keeps it (7–3650, default 30). Save.
- Export downloads a date range as CSV or JSON. Narrow it to Sign-ins, Admin changes or Task outcomes, or keep All events. Each export is itself recorded in the log.
A copy your admins can't edit
Anyone with Super Admin can change the retention. For an independent copy, add a Syslog / SIEM channel under Notifications with Also send the audit trail ticked. See Notifications & Alarms.
Support diagnostics¶
Settings → Support Diagnostics → Download diagnostics (Super Admins
only) downloads one .zip with what support asks for first:
- the running version compared with the configured one,
- each node's worker code version, and a live check of which workers answer,
- task failures from the last 24 hours,
- recent control-plane backups,
- current alarms,
- this console's recent warnings.
Passwords, keys, tokens and webhook URLs are removed before anything is written. Host names, IP addresses, user names and VM names stay in, so look through the file before you send it on. Each download is recorded in the cluster log.
Container logs aren't in this bundle. For those, use the diagnostics bundle on the HA Manager.