Audit Logs
Track team activity with audit logs. Monitor profile access, configuration changes, permission updates, and security events. Export logs for compliance.
Who launched which profile? Who changed team permissions? Who deleted that account? Audit logs answer these questions. Every action is tracked, timestamped, and attributed.
What Gets Logged?
We track every significant action in your account.
Profile Actions:
- Profile created, updated, deleted
- Profile launched, stopped
- Profile shared with team member
- Profile access removed
- Fingerprint settings changed
Team Actions:
- Member invited, accepted invitation
- Member removed from team
- Role changed (Member → Admin, etc.)
- Profile access granted or revoked
Security Events:
- Login from new device
- Failed login attempts
- API key created or revoked
- Two-factor authentication enabled/disabled
- Password changed
Configuration Changes:
- Proxy added, updated, or deleted
- Billing information updated
- Subscription plan changed
- Webhook endpoints configured
Accessing Audit Logs
Settings → Audit Logs (or Security → Audit Logs).
Who can access:
- Owner: Yes, all logs
- Admin: Yes, all logs
- Member: No, can't view logs
- Viewer: No, can't view logs
Only Owner and Admin roles have audit log access. This prevents team members from covering tracks.
Log Entry Format
Each log entry shows:
| Field | Description | Example |
|---|---|---|
| Timestamp | When action occurred | 2024-03-03 14:32:15 UTC |
| Actor | Who performed action | john@company.com |
| Action | What happened | profile.launched |
| Resource | What was affected | Profile: Facebook Account 1 |
| IP Address | Source IP | 192.0.2.42 |
| Device | Device info | Chrome on macOS |
| Result | Success or failure | Success |
Example log entry:
2024-03-03 14:32:15 UTC
john@company.com launched Profile: Facebook Account 1
From: 192.0.2.42 (New York, US)
Device: Chrome 120 on macOS 14
Result: Success
Filtering Logs
Use filters to find specific activities.
Filter by Actor: See everything one person did.
Filter by Action: Find all profile launches, all deletions, all permission changes.
Filter by Resource: Track history of specific profile.
Filter by Date Range: Last 24 hours, last 7 days, last 30 days, custom range.
Filter by Result: Show only failed actions (security monitoring).
Example filters:
- "Show all actions by alice@company.com in last 7 days"
- "Show all failed login attempts"
- "Show all profile deletions this month"
- "Show all actions on Profile ID prof_abc123"
Exporting Logs
Export logs for compliance, reporting, or external analysis.
Audit Logs page → "Export" button → Choose format:
- CSV: Open in Excel, Google Sheets
- JSON: Import into SIEM tools (Splunk, Datadog)
- PDF: Share with auditors or management
Exports include all visible logs after filters. Max 10,000 entries per export.
For full history or automated exports, use the API:
GET https://api.multilogin.io/v1/audit-logs?from=2024-01-01&to=2024-03-03&limit=1000Retention Policy
| Plan | Retention Period | Export Access |
|---|---|---|
| Solo | 30 days | CSV only |
| Team | 90 days | CSV, JSON |
| Enterprise | 1 year | CSV, JSON, PDF, API |
Older logs are automatically deleted. Export important logs before they expire.
Common Use Cases
Security Incident Investigation:
Profile got banned? Check audit logs to see who launched it, when, from which IP. Identify the problem and prevent recurrence.
Compliance Audits:
Export all logs for date range. Show auditors exactly who accessed what data and when. Demonstrate access controls and activity monitoring.
Team Performance Tracking:
Filter by team member to see their activity. How many profiles did they launch? Are they following procedures?
Unauthorized Access Detection:
Set up alerts for suspicious patterns:
- Logins from unusual locations
- Profile access outside business hours
- Multiple failed login attempts
- Bulk profile deletions
API Access
Programmatically retrieve audit logs via API.
Endpoint:
GET /v1/audit-logsQuery Parameters:
from- Start date (ISO 8601)to- End date (ISO 8601)actor- Filter by user emailaction- Filter by action typeresource_id- Filter by resource (profile, proxy, etc.)limit- Results per page (max: 1000)
Example request:
const response = await fetch('https://api.multilogin.io/v1/audit-logs?from=2024-03-01&action=profile.deleted', {
headers: {
'Authorization': `Bearer ${API_KEY}`
}
});Best Practices
- Review weekly: Check logs every week for unusual activity
- Export monthly: Archive logs for long-term retention
- Monitor failures: Failed logins and actions indicate problems
- Train team: Inform team that all actions are logged
- Set up alerts: Use webhooks to get notified of critical events
Kevin Park
Compliance & Security Engineer
Kevin Park designs compliance systems at Multilogin.io. He's built audit logging infrastructure processing 10M+ events daily with SOC 2 and GDPR compliance.