Activity & Access Audit Logs
Standalone Qwiki records authentication events, share-link visits, document and category mutations, lock takeovers, and admin settings changes to non-blocking, append-only JSON Lines files (content/.logs/activity-YYYY-MM.jsonl).
Using the Audit Dashboard
Open admin ▾ ➔ 📜 Activity & Access Log (tool-activity-log):
- Metric Overview Cards: View summary counts of logins, failed attempts, share visits, and content edits.
- Real-Time Filtering & Search: Filter by event category/status or run full-text search across actor, target slug, and metadata.
- Top Shared Document Analytics: See which cryptographic share links receive the most traffic.
- 1-Click CSV Export: Export filtered audit records for compliance reviews or external SIEM ingestion.
GDPR IP Privacy Modes & Retention
Inside the Activity & Access Log settings panel, configure how client IP addresses are stored:
| Mode | Stored Format | Best For |
|---|---|---|
hash (Default) |
12-character SHA-256 hash | GDPR-friendly unique visitor correlation without storing raw IPs |
masked |
Subnet mask (e.g., 192.168.1.0/24 or /48 IPv6) |
Network/region diagnostics with user-level anonymity |
raw |
Full IPv4/IPv6 address | Internal intranets requiring exact source-IP audit trails |
You can also configure log retention pruning (default: 30 days) or manually purge old logs from the dashboard.