Audit Trail

Audit Trail helps you track changes made by users across your account. It shows what was changed, who made the change, and when. This includes actions like creating, updating, or deleting Alerts, Apps, Pipelines, and other important resources. This feature is useful for reviewing changes over time, identifying who changed what and when, troubleshooting account issues by checking recent updates, and improving visibility and accountability across your team.

What It Tracks

Every time a user makes a change, an event is recorded in the Audit Trail. In addition to tracking manual user actions, Audit Trail also tracks certain changes that are automatically made by the Sematext system to help with the setup and configuration. For example, when you create a new App, we automatically create default alert rules tailored to the selected integration type. These defaults are designed to help you start monitoring key metrics and logs with minimal setup. These system-initiated actions appear in the Audit Trail with the user listed as sc-system@sematext.com.

Below is the full list of tracked event types:

Plan, Subscription, and Billing Account Changes

Includes updates to plans, retention periods, daily and hard limits across all solutions. Also covers changes related to payment methods and billing emails.

Team and Permissions

Tracks changes related to account members and App guests, such as:

• Adding or removing account members
• Changing roles of account members
• Adding or removing App guests
• Changing roles of App guests
• Conversion of the account to a team account

App Lifecycle and Auto Monitoring

Tracks important changes related to your Apps and their monitoring setup. It includes the creation, disabling, and deletion of Apps across all Sematext solutions. It also covers special cases like Apps disabled due to failed payments. Additionally, it tracks when automatic metrics or logs monitoring and shipping are enabled or disabled, along with changes to the destination App for logs or metrics.

Alert Rule Changes

Tracks when alerts are created, deleted, enabled, or disabled, as well as any updates made to alert rules. This includes changes to alert conditions, queries, filters, schedules, names, priorities, group-by and roll-up settings, metrics, and transformation scripts. It also captures changes to notification settings and hooks.

Synthetics Monitoring

Tracks creation, updates, disabling, and deletion of monitors. This includes:

• Changes to monitor URLs, device types, run intervals, locations, and conditions
• Status pages and scheduled pauses being created, updated, or deleted
• SSL certificate tracking and validation toggled on or off
• Updates to request settings and authentication
• Monitor type changes (URL/script-based), as well as script and secret variable updates

Pipelines and Processors

Records creation, updates, removal, enabling, and disabling of processors. Tracks detailed changes to processor settings such as field mappings, filters, target/source fields, scripts, sampling rates, and processor ordering.

Reports and Dashboards

Tracks creation and updates of reports at both App and Dashboard levels, updates to report components, and creation or deletion of dashboards.

When multiple settings are changed at once — such as editing several fields in an alert rule — Audit Trail records them as a single grouped event. Within the event flyout, we show each changed item along with its previous and new values.

How to Use It

You can access the Audit Trail from your Sematext Cloud account. It allows you to:

• Filter events by user, event type, or by the App where the user performed the action
• View the most frequent actions in the Top Events section
• Click from an event to open the related App, Alert Rule, Pipeline, or other resource
• See a timestamp and the user responsible for each action

Audit Trail can be enabled or disabled at any time from your account settings. Only users with the Account OWNER role can change this setting. If you want to share Apps, Dashboards, and Alert Rules with others or use Sematext as a team or company, we recommend creating a Team Account using a shared group email (e.g., dev@..., engineering@..., monitoring@...). This account isn’t tied to any individual’s email and doesn’t incur additional costs. You can then invite everyone who needs access to collaborate within that account.