Appearance
Event Viewer
Event Viewer is the account audit log in the operator console. It shows who changed configuration in your account and selected system activity (for example agent tunnels connecting, enrollment completing, and billing outcomes from payment processing).
It is not the same as Request Lookup, which traces individual HTTP calls to your service hostnames.
Open Event Viewer
- Select your account in the header.
- Open Event Viewer in the left navigation.
You need permission to view the account audit event log. If the menu item is missing, ask an account administrator to grant that permission on your role.
You can also open a filtered panel from an Agent or Service detail page: use the page menu → View Events.
What you will see
Each row includes:
| Column | Meaning |
|---|---|
| Event ID | Stable id for the row (copyable) |
| Timestamp | When the event occurred (shown in your browser’s local time) |
| Type | Short machine-readable type (for example service created, agent enabled, tunnel connected) |
| User | Operator display name, or a System chip for non-operator activity |
| Service / Agent | Linked when the event relates to that resource |
| Details | Short human-readable description |
Results are listed in time order (oldest first) within each page. Use the arrow buttons to move between pages.
What gets recorded
Examples of activity that appear in Event Viewer:
| Category | Examples |
|---|---|
| Agents | Enable, disable, update, delete; upgrade requested / upgraded / upgrade failed; tunnel connected / disconnected |
| Enrollment | Enrollment approved; enrollment completed after the agent finishes certificate setup; certificate renewed; enrollment expired when a code is no longer valid |
| Services | Create, update, enable/disable, delete |
| Credentials & service keys | Create, update, rotate secret, enable/disable, delete |
| Users & IAM | Invites, membership changes, role changes |
| Billing | Starting checkout or the customer portal from the console; plan / tier changes; subscription and payment outcomes such as checkout completed, invoice paid, payment failed, or subscription canceled |
System rows are written by the platform (tunnels, certificate lifecycle after approval, payment processor outcomes), not by a signed-in operator click.
Upgrade examples:
| Type | Actor | Meaning |
|---|---|---|
| Agent Upgrade Requested | Operator | Someone clicked Upgrade while the agent was online |
| Agent Upgraded | System | Agent reconnected at the requested version (or newer) after the upgrade was sent |
| Agent Upgrade Failed | System | Agent reconnected still below the requested version after an upgrade was sent |
To restore the previous binary on the host after a successful upgrade, see Operations — Roll back to the previous version.
Not in Event Viewer
- Per-request HTTP ingress records — use Request Lookup
- Ordinary application logs on the agent host
Filter events
Use the search panel, then Search:
| Filter | Behavior |
|---|---|
| Service | Events for one service (deleted services still appear in the list, marked as deleted) |
| Agent | Events tied to one agent |
| User | Events performed by one account member (does not match System rows) |
| After / Before | Local date and time window |
Clear a filter with the control’s clear affordance, or clear all filters and search again for a broader window.
When you open View Events from agent or service detail, the relevant agent or service filter is already applied.
Permalinks
Changing filters updates the browser address bar so you can bookmark or share a link to the same search. Recipients need access to the same account and permission to view the audit event log.
Retention
Audit events are kept for 180 days, then removed automatically.
Related
- Request logging — HTTP traffic through your service hostnames
- Troubleshooting — using Request Lookup and Event Viewer together
- Billing — subscription status and payment management