Tracking events and user actions with the Activity Log

Trento collects system events and user actions in the Activity Log. It records what happened in the monitored landscape and who triggered the event. With the Activity Log, you can discover health and heartbeat changes, host de-registrations, login attempts, user updates and more.

The Activity Log can be accessed from the left-hand side panel of the Trento console.

Understanding an Activity Log entry

Entries are listed from newest to oldest. Each entry in the Activity Log includes the following information:

Timestamp

When the system event or user action occurred. Timestamps are displayed in the user’s preferred timezone, which is set in the user profile. If no preference is set, times default to UTC.

Message

Type of the occurred event or user action.

User

The user that triggered the event or performed the action. User system marks events triggered by the system itself.

Severity status

The log shows Info, Warning and Critical entries by default.

The list view is a summary. To see the full context of an entry, such as the affected resource and the values involved, click the chevron icon (>) on the entry. This opens the Activity Details window with the activity metadata.

Filtering for relevant log entries

You can use filters to isolate the entries you are interested in. For more specific queries, use the search field to find exact terms from the activity metadata, such as a specific host name or setting value.

  1. In the Activity Log view, set one or more of the following filters:

    • User: The user who triggered the entry. Only active users are available for filtering.

    • Type: The type of event or user action.

    • Severity: Info, Warning, Critical, or Debug.

    • From date and To date: A date and time range. Both accept user’s preferred timezone. If no preference is set, time defaults to UTC.

  2. To match the content of the activity metadata, enter a query in the search field.

    The field supports wildcards and the OR and AND logical operators, which you can combine in a single query. Operators are parsed from left to right, and OR is applied by default. For example, the query term1 term2 term3 is treated as term1 OR term2 OR term3.

  3. Click Apply Filter.

To remove all the filters, click Reset Filters.

Following a chain of related events

Certain user actions and system events trigger a multi-step workflow that produces several log entries. Trento correlates those entries, so that you can review the workflow as one chronological, linear chain instead of reconstructing it from individual entries.

Example workflows that produce such chains include:

  • De-registration of hosts

  • API key re-generation

  • SUSE Multi-Linux Manager settings save or update

  • Host, cluster and SAP operations

For example, cleaning up a host that runs a single-instance SAP HANA database de-registers the database instance, the database itself, the SAP system and its instances, and then the host.

To review the whole chain:

  1. Click the chevron icon (>) for the action that is a part of the workflow to open the Activity Details window.

  2. In the Related Events section, click Show Events.

    The Activity Log is then automatically filtered by correlation_id to show you the chain of related events.

Not every entry must belong to a chain. If an entry is not part of a larger workflow, clicking Show Events filters the log to display only that single entry.

Refreshing the Activity Log

New entries are not automatically added to an open view. Click Refresh to load any new entries generated since the view was opened or last refreshed. If you are monitoring an ongoing operation, select an auto-refresh interval instead and let the view update itself.

Getting access to user data

Not every user sees the same Activity Log. Permissions govern which entries are listed, and whether the user names in them are readable.

all:all and all:users

Entries related to user management can only be displayed by users that have the all:all or all:users permissions.

This includes for example:

  • Login attempts

  • User creations

  • User modifications

  • User deletions

  • Profile updates

activity_log:users

This permission controls a privacy-related access level. For users without this permission, only their own user name and the user system is visible in the Activity Log.

For more information about permissions, see [sec-trento-user-management].

Modifying log retention time

Entries are retained for one month by default. Increase the retention time if you need a longer audit history, or reduce it to limit database growth. Changing it requires the all:settings permission.

  1. In the left sidebar of the Trento Web console, click Settings.

  2. In the Activity Logs section, click Edit Settings.

  3. Set the desired retention time and save the change.

Entries older than the retention time are deleted every day at midnight UTC. The cleanup schedule always uses UTC, regardless of the preferred timezone that the console uses to display timestamps.