Action Logs
An ActionLog is an audit log of file actions performed by users or the system.
Logs available through this endpoint are retained for 6 months, after which they are automatically discarded. For longer retention, use Files.com SIEM integrations to stream logs in real time to your preferred SIEM, or configure SIEM streaming to a file.
List Action Logs
Command
files-cli action-logs list
Output
Outputs a list of ActionLog objects according to the output format.
Authorization Requirement
Available to all authenticated keys or sessions.
Additional Arguments
The ActionLog Object
Some of the commands above return a ActionLog object. The attributes of this object are listed below.
| Attribute | Description |
|---|---|
| action string | The type of action performed |
| created_at date-time | Time the action was performed |
| destination string | Destination path, for moves and copies |
| failure_type string | Failure type, if applicable |
| folder string | Folder involved in the action |
| interface string | Interface used to perform the action |
| ip string | IP address from which the action was performed |
| metadata_dm_id int64 | File or Folder ID associated with the action |
| parent_metadata_dm_id int64 | Parent File or Folder ID associated with the action |
| path string | File path. This must be slash-delimited, but it must neither start nor end with a slash. Maximum of 5000 characters. |
| site_id int64 | Site ID where the action took place |
| src string | Source path, for moves and copies |
| user_id int64 | User ID who performed the action |
| username string | Username who performed the action |