> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Auditing

> Track who accessed and changed what across PAM.

Infisical adds an event to the audit log each time someone connects to an account, views a credential, or changes PAM's configuration. Use the audit log for access reviews and to trace what happened before and after an incident.

The audit log records that something happened, such as a user starting a session on an account. To view what the user did during that session, use the [session recording](https://infisical.com/docs/documentation/platform/pam/sessions/session-recording.md).

## Who can view the audit log

What you can view depends on your [roles](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md):

* With the **Admin** or **Auditor** role on a folder or account, you can view the events for that folder or account, including the events for every account in the folder
* With the **Product Admin** role, you can view the events that don't belong to a folder or account, such as changes to templates and product members

## View the audit log

Go to **Privileged Access Management** > **Audit Logs**. The audit log shows the newest events first.

Each event names the actor, the action, and the folder or account it affected, along with when it happened. If the actor was a [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md), the event shows **Machine Identity** in place of an email address. When an [AI agent](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview.md) connects to an account, Infisical records the event under the user or machine identity that started the agent.

To filter events by date, event type, or actor, check out [Filtering audit logs](https://infisical.com/docs/documentation/platform/audit-logs.md#filtering-audit-logs). For filters that answer common PAM questions, such as who accessed an account, check out [Common filters](https://infisical.com/docs/documentation/platform/audit-logs.md#privileged-access-management-pam).

## What gets logged

| Category | Events |
| - | - |
| Sessions | Start PAM Session, End PAM Session, Terminate PAM Session, Access PAM Account |
| Credentials | View PAM Account Credentials, Rotate PAM Account Credentials, Set PAM Account Rotation Account |
| Accounts | Create PAM Account, Update PAM Account, Delete PAM Account, Create PAM Account SSH CA |
| Folders | Create PAM Folder, Update PAM Folder, Delete PAM Folder, Org admin accessed PAM folder |
| Templates | Create PAM Account Template, Update PAM Account Template, Delete PAM Account Template |
| Memberships | Add, Update, and Remove PAM Product Member, PAM Folder Member, and PAM Account Member |
| [Access requests](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md) | Create PAM Access Request, Review PAM Access Request, PAM Access Request Auto-Approved, Revoke PAM Access Grant, Update PAM Approval Configuration, PAM Access Policy Bypassed |
| [Discovery](https://infisical.com/docs/documentation/platform/pam/discovery/overview) | Create, Update, and Delete PAM Discovery Source, Run PAM Discovery Scan, Import PAM Discovered Account |

To review every use of [break-glass access](https://infisical.com/docs/documentation/platform/pam/access-requests/break-glass.md), filter for **PAM Access Policy Bypassed**. Each of these events records the reason the user gave, the account and folder, and how many approvers were skipped.

## Retention

How long Infisical keeps audit log events depends on your [plan](https://infisical.com/pricing). To keep events for longer, send them to your own logging system with an [audit log stream](https://infisical.com/docs/documentation/platform/audit-log-streams/audit-log-streams.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.