This is the documentation page for an unsupported version of Zabbix.
Is this not what you were looking for? Switch to the current version or choose one from the drop-down menu.
Table of Contents

7 Audit

Overview

In the Administration → Audit section users can view records of changes made in the frontend and details of executed actions.

By default frontend audit records are displayed. To switch to action details and back, use the dropdown in the top right-hand corner.

Audit log

In this screen the audit log of various changes made in the frontend can be seen. You can use the filter, located below the Audit log bar, to narrow down the records by user, activity type, affected resource and the time period.

Displayed data:

Column Description
Time Timestamp of the audit record.
User User of the activity.
IP IP that was used in the activity.
Resource Affected resource is displayed.
Action Activity type is displayed - Login, Logout, Added, Updated, Deleted, Enabled or Disabled.
ID ID of the affected resource is displayed.
Description Description of the resource is displayed.
Details Detailed information on the performed activity is displayed.

Action log

In this screen details of operations (notifications, remote commands) executed within an action are displayed.

You can use the filter, located below the Action log bar, to narrow down the records by recipient of e-mail and time period.

Displayed data:

Column Description
Time Timestamp of the operation.
Action Name of the action causing operations is displayed.
Action name is displayed since Zabbix 2.4.0.
Type Operation type is displayed - Email or Command.
Recipient(s) User alias, name and surname (in parenthesis) and e-mail address of the notification recipient is displayed.
User alias, name and surname are displayed since Zabbix 2.4.0.
Message The content of the message/remote command is displayed.
Status Operation status is displayed:
In progress - action is in progress
For actions in progress the number of retries left is displayed - the remaining number of times the server will try to send the notification.
Sent - notification has been sent
Executed - command has been executed
Not sent - action has not been completed.
Info Error information (if any) regarding the action execution is displayed.