Skip to main content

Logging events

Logs are a vital tool for system diagnostics, event auditing, user management, reporting, and more. They capture detailed information about each event including the client's IP address, the user involved, the date and time, and the specific action taken.

Event logging in authentik is highly configurable. You can set the retention period for storing and displaying events, specify which events should trigger a notification, and access low-level details about when and where each event occurred.

Troubleshooting with event logs​

For guidance on troubleshooting with logs, including setting log levels (info, warning, etc.), enabling trace mode, viewing historical logs, and streaming logs in real-time, see Capturing logs in authentik.

Enhanced audit logging Enterprise​

In the enterprise version, two enhancements make reading the logs even easier:

  • the Event details page in the user interface presents abstracted and easily accessible information about each event in an easy-to-access table.

  • for any event that involves the creation or modification of an object, the corresponding code differences are displayed, allowing for comparison of the previous and new configuration settings or values. For example, if an authentik administrator updates a user's email address, both the old and new email addresses are displayed in the event's detailed view. (In the open source version, event details only show that a change was made and which application and model was involved.)

You can view audit details in the following areas of the authentik Admin interface:

  • Admin interface > Dashboards > Overview: In the Recent events section click an event name to view its details.

  • Admin interface > Events > Logs: In the event list, click the arrow toggle next to the event you want to view.

Viewing events in maps and charts Enterprise authentik: 2025.8.0+​

With the enterprise version, you can view recent events on both a world map view with pinpoints indicating where each event occurred and also a color-coded chart that highlights event types and volume.