Activity log

Compliance > Audit log (/compliance/audit) is the server's whole activity record, searchable and exportable. Since 4.1.2 it holds:

Each entry has the time (UTC), who did it, the account or domain it was done to, the address it came from, the action and what it acted on, and whether it was accepted. A form's password, key or token is never recorded: only the fields that name what was acted on (account, domain, mailbox, database, plan, path) are kept.

Pages and downloads​

Since 4.1.2 a line of the customer panel's log also says what the entry is: kind=change (a form or API call that changes something), kind=view (a page opened) or kind=download (a file taken away: a backup, an export, a zone file). A read is recorded under rules that keep the log to what a person did:

• Only a successful answer. A refused or missing page is not an action of the account; a refused change is still recorded, as refused.
• Only what the person did: a page the browser opened, and an API call made with a token. What a page's own script fetches in the background (a status that refreshes, a list it loads, a live feed) is not recorded, nor are static files, health checks or anything with an asset file extension.
• The route and the fields that name what was opened (domain, mailbox, database, path) are kept, never the query string: a password, a token or a search text in a link does not reach the log, and neither does a file's contents. A piece of a path that looks like a token or a one-time link is written {id}.
• The same page of the same target opened again within five minutes is one line; the same file downloaded again within ten seconds is one line (a double click, a resumed transfer).
• An account is listed for at most 300 views and 200 downloads an hour. When it reaches the cap one GET (volume cap) line says so, and the first line of the account in the next hour says how many were not listed. A change is never limited.

The customer portals (Mail, DNS and S3) reach the panel through the portal API on 127.0.0.1:2094, not through the customer panel's own port, and write the same lines there: portal-dns:GET /dns/zones/{z}/records, with the zone, the domain or the mailbox the route names and the answer, under the same rules. The portal's own reads (its own account, its activity feed) are not recorded.

Finding entries​

Filter by Action (part of it: suspend, admin:, panel.login), by any word (Search), by Subject (an account, a domain or an address, matched exactly), by Actor and by date. The newest entries come first. Download these entries (CSV) saves the filtered entries; Export builds the signed bundle an authority asks for.

The files under /var/log are read in each time the page is opened, so a change made a moment ago is already there. The accounts' own activity logs are read by the hourly hitechcloudcli compliance-run -ingest.

Resellers​

A reseller has its own Accounts > Activity log (/account/audit): the pages the accounts it owns opened, the files they downloaded, the changes they made and the sign-ins refused to them, in the customer panel and the portals, with the same filters (account, kind, search, dates) and the CSV download. It lists those accounts only. It never lists another reseller's customers, an administrator's actions, or the server's own entries, whatever is typed into the filters, and an account that is not the reseller's gives an empty page. An action an administrator took while signed in as one of the reseller's accounts is the account's entry, and says so (impersonated_by). An account moved to another reseller leaves the first reseller's list; the entries stay in the chain. The CSV has no sequence numbers or hashes. Administrators read everything at Compliance > Audit log.

Tamper resistance​

The source files belong to root and no account can read or change them. Every entry, once read in, is in the audit chain: an append-only database whose entries each commit to the one before, sealed and signed each day. Changing or removing an entry breaks every hash after it, and the page says so.

Rotation and retention​

hitechcloudcli server-logrotate rotates admin/*.log and user/*.log daily and keeps them for at least 12 months, the floor of Nghị định 53/2022/NĐ-CP; a line written just before a rotation is still read in, from the rotated copy. The audit chain itself is never trimmed.