Audit Trail

Task-oriented recipes. Each section assumes you already have splam installed and running. See the Tutorial if not.

Review the audit trail for a service

Select the service in the sidebar, then open the Audit Trail tab. Entries are newest first and show timestamp, user, service, action, result, and the reason given.

Entries are stored as JSON lines in audit_log.jsonl in the app’s data directory (override with SPLAM_AUDIT_LOG), one file per app instance, written mode 0600.

The tab shows actions for the selected service, plus every login and logout attempt. Auth entries carry no service, so they stay visible whichever service a user has selected, and show a - in the service column.

The action (start/stop/restart) and result (e.g. restart ok, or an error from systemctl) are highlighted the same way as the Logs and Status tabs.

See Configure Highlighting to add your own keywords.