# Audit Trail

Task-oriented recipes. Each section assumes you already have `splam` installed and running. See the [Tutorial](tutorial-getting-started.md) if not.


# Review the audit trail for a service

Select the service in the sidebar, then open the **Audit Trail** tab. Entries are newest first and show timestamp, user, service, action, result, and the reason given.

Entries are stored as JSON lines in `audit_log.jsonl` in the app's data directory (override with `SPLAM_AUDIT_LOG`), one file per app instance, written mode `0600`.

The tab shows actions for the selected service, plus every login and logout attempt. Auth entries carry no service, so they stay visible whichever service a user has selected, and show a `-` in the service column.

The action (start/stop/restart) and result (e.g. `restart ok`, or an error from `systemctl`) are highlighted the same way as the Logs and Status tabs.

See [Configure Highlighting](01.10-how-to-configure-highlighting.md) to add your own keywords.