Keeps a panel activity log and provides a page to browse, filter and export it.

Entries are stored as JSON lines in a file, one object per line, each carrying a UTC timestamp, action name, username, free-text detail, IP address and a severity derived from a fixed action-to-severity table (logins, domain and database changes, plugin installs, file deletions, config changes, firewall changes and similar). Reading supports filtering by user, exact action, severity and an age window in days, with a result limit. Alongside the browser there are summary statistics (total entries, entries today, warning count) which also drive the sidebar badge and dashboard widget, a CSV export covering the last N days, pruning by a configurable retention period (also applied weekly by a cron job), alerts on critical events (2FA disabled, repeated failed admin sign-ins, log deletion, app installs/removals, server identity changes), and a full clear.

Other plugins or panel code can append to the log by calling the log_action action. If the log file is missing or a query returns nothing, the plugin falls back to reading the panel's built-in AuditLog model so the page is not empty on a fresh install. Worth being clear about the limitation: this plugin does not instrument the panel by itself — what shows up is whatever was explicitly logged plus whatever the fallback model already records. All actions are admin-gated.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Included with Enterprise

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.0.4 — Forwarding: every log entry can also go to local syslog (facility of choice), a remote syslog server (UDP/TCP, RFC 5424) and/or an HTTPS webhook signed with HMAC-SHA256, in the background so logging never waits; secret-looking fields are masked. 1.0.3 — Retention is a setting (7–3650 days, default 90) used by Prune and by the weekly prune job, which now prunes by age instead of emptying the file at 50 MB. Alerts (bell + the admin's alert channels, each switchable): two-factor authentication disabled, 5+ failed sign-ins to an admin account within 15 minutes, activity-log entries deleted or the audit log cleared, an app installed or removed, and the server identity changed. 1.0.2 — The Last action card shows the action instead of [object Object], Export with All time exports everything, and the Error filter lists failed actions. 1.0.1 — The log file is handed to the panel user (it was root-only): the counters showed 0 while the list had entries, and Prune/Clear failed with "Permission denied". Counters and list now always use the same source. 1.0.0: Initial release. File-based JSON log, filter by user/action/date, CSV export.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/audit-log/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "audit-log",
  "version": "1.0.4",
  "download_url": "..."
}