Audit Log

Introduction #

The audit logs make it possible to track activities on the entire server without having to search through logs.

Audit log #

The audit log is available under Settings → Audit log. Access is role-based: Auditor accounts can review all records; Manager accounts see only device-scoped records for their assigned groupings; all other account types have no access. The data is saved for 180 days by default and can be easily searched within the Relution portal.

The following columns are available for information:

• Timestamp
• User name
• Method (POST, GET, PUT, DELETE)
• Description
• Status
• Organization
• IP ADDRESS
• Endpoint

This allows all changes to be tracked.

Storage Limit Behaviour #

Audit records are automatically purged when they exceed the configured retention period of 180 days. The cleanup runs periodically during off-peak hours, deleting records in batches to avoid database locks.

If disk space is exhausted before cleanup runs, new audit records may fail to write. The System Administrator must monitor disk usage and ensure sufficient storage is available for the configured retention period. There is no automatic low-storage notification — this is a System Administrator responsibility.

Audit Trail Integrity #

The audit trail is a security property, not a configurable feature.

nginx Access Logs #

The nginx reverse proxy logs every HTTP/HTTPS request, including the TLS protocol and cipher suite negotiated for the connection. These logs complement the Relution application audit log for the network channel layer.

Accessing the logs:

docker logs nginx

Or to follow in real time:

docker logs -f nginx

Each access log line has the format defined in relution-nginx.conf:

<remote_addr> - <user> [<time>] "<request>" <status> <bytes> "<referer>" "<user_agent>" "<x_forwarded_for>" <request_time> <upstream_time> <pipe> <ssl_protocol> <ssl_cipher>

The $ssl_protocol and $ssl_cipher fields at the end of each line record the TLS version and cipher suite used for that connection (e.g. TLSv1.3 TLS_AES_256_GCM_SHA384). These are only populated for HTTPS requests; HTTP requests (redirected to HTTPS) log - for both fields.

The error log is written to stderr and is also accessible via docker logs nginx.

Audit Event Reference #

Server Log References #

Encryption/Decryption integrity failures:

INTEGRITY_FAILURE operation=ENCRYPT entity={} attribute={} outcome=FAILURE subject={}
INTEGRITY_FAILURE operation=DECRYPT entity={} attribute={} outcome=FAILURE subject={}
TLS_INTEGRITY_FAILURE host={} outcome=FAILURE reason="{}" error="{}"

Cryptographic key derivation:

CRYPTO_KEY_DERIVATION category={} algorithm={} purpose="{}"
CRYPTO_KEY_DERIVATION category={} algorithm={} iterations={} purpose="{}"
TLS_KEY_DERIVATION outcome={} info="{}"

TLS channels:

TLS_CHANNEL_ATTEMPT host={} port={} tls={} cipher={} cert_subject="{}" cert_fingerprint={}
TLS_CHANNEL_SUCCESS host={} outcome=SUCCESS
TLS_CHANNEL_FAILURE host={} outcome=FAILURE reason="{}"