How to Check Kintone Audit Logs / Log List
Using audit logs of Kintone, you can check who performed what kind of action on Kintone and when it was performed.
Audit logs can be checked on Users & System Administration.
Checking the audit log
-
Click the Settings button
at the upper right of the screen and then click Users & System Administration.
-
Click View & Download under Audit Logs.
-
Specify filter conditions to the extent you can and click View.
Audit log entries that meet the specified conditions are displayed at the lower area of the screen.
-
To check the details of an audit log entry, click the i icon.
-
If necessary, configure the settings for audit logs or export audit logs.
Audit logs
The following sections describe the audit logs that are generated when actions are performed on Kintone.
App Settings
The table below describes audit logs that are generated when actions are performed on App Settings.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Notice | App management | App update | app id: [app ID], app name: [app name], record comment: [true/false] | The Comment feature for records was enabled/disabled. |
Notice | App management | App update | app id: [app ID], app name: [app name], record history: [true/false] | The Change History feature was enabled/disabled. |
Notice | App management | App update | app id: [app ID], app name: [app name], bulk delete: [true/false] | The Bulk Deletion feature was enabled/disabled. |
Information | App management | App create | app name: [app name], app group id: [app group ID] | An app was created. |
Information | App management | App create from template file | file name = [app name], template name: [comma-separated list of template names], app group id = [app group ID] | An app was created via importing of an app template file on the Marketplace. |
Information | App management | App delete |
If only one app was deleted: app id: [app ID], app name: [app name] If multiple apps were deleted in bulk: app id: [app ID], app name: [app name], (app id: [app ID], app name: [app name]), (..... |
An app(s) was deleted. |
Information | App management | App restore |
If only one app was restored: app id: [app ID], app name: [app name] If multiple apps were restored in bulk: app id: [app ID], app name: [app name], (app id: [app ID], app name: [app name]), (..... |
An app(s) was restored. |
Information | App management | App update | app id: [app ID], app name: [app name], target: general | The Appearance setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: form | The Form setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: view | A view was added, edited, or duplicated. |
Information | App management | App update | app id: [app ID], app name: [app name], target: notification | The Notifications setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: title | The Title Field setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: category | The Categories setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: report | A graph was added, edited, or duplicated. |
Information | App management | App update | app id: [app ID], app name: [app name], target: status | The Process Management setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: action | An app action was added, edited, or deleted. |
Information | App management | App update | app id: [app ID], app name: [app name], target: app acl | The Permissions for App setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: record acl | The Permissions for Records setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: field acl | The Permissions for Fields setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: info | The Misc Settings were changed. |
Information | App management | App update | app id: [app ID], app name: [app name], record duplication: [true/false] | The Duplicate Record feature was enabled/disabled. |
Information | App management | App update | app id: [app ID], app name: [app name], target: resource | The Localization setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: customize | The JavaScript and CSS Customization setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: plugin | A plug-in was added, deleted, enabled, or disabled; or its setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: api token | The API Token setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: webhook | The Webhooks setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: theme | The Color Theme setting was changed. |
Information | App management | App update | app id: [app ID], app name: [app name], target: icon | The app icon was changed*2 |
Information | App management | App report delete | app id: [app ID], app name: [app name], report id: [graph ID], report name: [graph name] | A graph was deleted. |
Information | App management | App view delete | app id: [app ID], app name: [app name], view id: [view ID], view name: [view name] | A view was deleted. |
Information | App management | App change discard | app id: [app ID], app name: [app name] | Changes to App Settings were discarded. |
Information | App management | App change deployed | app id: [app ID], app name: [app name] | Changes to App Settings were deployed. |
Information | App management | Add slack integration | app id: [app ID], app name: [app name], slack workspace: [URL of the integrated Slack] | An app was integrated with a Slack workspace. |
Information | System administration | Template download |
If the download was successful: The following two logs are generated.
app id: [app ID], template name: [template name] |
An app was downloaded as an app template. |
Information | App management | App move started |
If an app that belonged to a space was moved to a different space: If an app that belonged to a space was moved outside of any spaces: If an app that did not belong to any space was moved inside a space: |
Which space an app belongs to was changed. |
*1: The log is generated when the Save button is clicked on the "Appearance" setting screen.
*2: The log is not generated when the app icon is changed via the Appearance setting.
Actions on app records
The table below describes audit logs that are generated when actions are performed on app records.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Information | App operation | Record file upload | app id: [app ID], app name: [app name], record id: [record ID], filename: [file name] | A file was attached to a record. |
Information | App operation | Record file download | app id: [app ID], app name: [app name], record id: [record ID], filename: [file name] |
An attachment was downloaded. |
Information | App operation | Record comment delete | app id: [app ID], app name: [app name], record id: [record ID], comment id: [comment number] | A comment was deleted. |
Information | App operation | Record delete | app id: [app ID], app name: [app name], record id: [[comma-separated list of record IDs]] | A record was deleted. |
Information | App operation | Record bulk delete | app id: [app ID], app name: [app name] | Records were deleted in bulk.*1 |
Information | App operation | Record import registered | app id: [app ID], app name: [app name], number of file lines: [number of file lines*2], file size: [file size], filename: [file name] |
A file to be imported into an app was registered. |
Information | App operation | Record import started | app id: [app ID], app name: [app name], number of file lines: [number of file lines*2], file size: [file size], filename: [file name] |
The import of record data from a file started.*1 |
Information | App operation | Record import finished*3 | app id: [app ID], app name: [app name], number of file lines: [number of file lines*2], file size: [file size], filename: [file name] |
The import of record data from a file was completed.*1 |
Information | App operation | Record export | app id: [app ID], app name: [app name] | Record data was exported to a file.*1 |
Information | App operation | Report export | app id: [app ID], app name: [app name] | A graph was exported to a file.*1 |
Information | App operation | Exported file download | app id: [app ID], app name: [app name], filename: [file name] | A file that contains exported record data was downloaded. |
Information | App operation | Webhook notify |
If the notification was successfully sent: If the notification could not be sent due to an error attributable to Kintone: app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS / DELETE_RECORD}, server url: [destination server URL], error type: SERVER_ERROR, status code: [HTTP status code of the notification] |
A Webhook notification was sent. |
Information | App operation | Send slack dm |
If the notification was successfully sent: If the notification could not be sent due to an error attributable to Kintone: app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], error type: SERVER_ERROR, status code: [response status code from failed Slack API], error message: [error message] |
A Slack notification was sent. |
*1: The Accessed section of the log details displays "127.0.0.1" regardless of the device on which the action was performed.
*2: If the user who performs the action sets the first row of the file as the header when importing a file, the number of file lines specified in the log will be 1 less than the actual number of lines in the file.
*3: The actions performed before the August 2021 update are logged as "Record import".
Portal
The table below describes audit logs that are generated when actions are performed on Portal.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Information | Portal operation | Portal announcement file download | filename: [file name] | A file or image attached to the Announcement section was downloaded or displayed in a slide show. |
People
The table below describes audit logs that are generated when actions are performed on People pages.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Information | People operation | People comment file download | user: [login name], comment url: [post/comment URL], filename: [file name] | A file or image attached to a post or comment was downloaded or displayed in a slide show. |
Messages
The table below describes audit logs that are generated when actions are performed on messages.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Information | Message operation | Message comment file download | users: [[comma-separated list of login names]], comment url: [post URL], filename: [file name] | A file or image attached to a post was downloaded or displayed in a slide show. |
Spaces
The table below describes audit logs that are generated when actions are performed on spaces.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Information | Space management | Space add | space id: [space ID], space name: [space name] | A space or guest space was created. |
Information | Space management | Space update | space id: [space ID], space name: [space name] | The Space Settings were changed. |
Information | Space management | Space delete |
If there were no apps placed in the space: space id: [space ID], space name: [space name] If there were any apps placed in the space: space id: [space ID], space name: [space name], (app id: [app ID], app name: [app name]), (..... |
A space was deleted.*1 |
Information | Space management | Space restore |
If there were no apps placed in the space when the space was deleted: space id: [space ID], space name: [space name] If there were any apps placed in the space when the space was deleted: space id: [space ID], space name: [space name], (app id: [app ID], app name: [app name]), (..... |
A space was restored. |
Information | Space operation | Space join | space id: [space ID], space name: [space name] | A user joined a space.*1 |
Information | Space operation | Space leave | space id: [space ID], space name: [space name] | A user left a space.*1 |
Information | Space operation | Space body file download | space id: [space ID], space name: [space name], filename: [file name] |
A file uploaded to the body of a space was downloaded, or an image attached to the body of a space was displayed in a slide show. |
Information | Space operation | Thread body file download | space id: [space ID], space name: [space name], thread id: [thread ID], thread name: [thread name], filename: [file name] |
A file uploaded to a thread body was downloaded, or an image attached to a thread body was displayed in a slide show. |
Information | Space operation | Thread comment file download | space id: [space ID], space name: [space name], thread id: [thread ID], thread name: [thread name], comment url: [post/comment URL], filename: [file name] |
A file uploaded to a post or comment in a thread was downloaded, or an image attached to a post or comment in a thread was displayed in a slide show. |
Information | Space template | Space Template add | space template id: [space template ID], space template name: [space template name] | A space template was created. |
*1 This log is generated also when the action to change space members or delete a space is performed via the Space Management setting in Kintone Administration.
Guest spaces
The table below describes audit logs that are generated when actions are performed on guest spaces.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Notice | Guest management | Invite guest | space id: [space ID], space name: [space name], Email: [[comma-separated list of e-mail addresses]] | A guest invitation e-mail(s) was sent. |
Notice | Guest operation | Integrate account | domain id: [domain ID of the guest space that was joined] | A user joined a guest space in a different domain. |
Notice | Guest operation | Guest download file | login name: [login name of the guest user], app id: [app ID], app name: [app name], record id: [record ID], filename: [file name], space id: [space ID], space name: [space name] |
A guest user downloaded an attachment.*1 |
Notice | Guest operation | Guest export record | login name: [login name of the guest user], app id: [app ID], app name: [app name] | A guest user exported record data to a file.*2 |
Notice | Guest operation | Guest integrate account | login name: [login name of the guest user], domain id: [home domain ID] | An invitee registered an account (signed up with the invitee's own Kintone account).*3 |
Information | Space management | Space add | space id: [space ID], space name: [space name] | A space or guest space was created. |
Information | Guest operation | Guest sign up | login name: [login name of the guest user], space id: [space ID], space name: [space name] | An invitee registered an account (registered a new guest account).*3 |
Information | Guest operation | Guest join space | login name: [login name of the guest user], space id: [space ID], space name: [space name] | A guest user joined a space. |
Information | Guest operation | Guest withdraw | login name: [login name of the guest user], space id: [space ID], space name: [space name] | A guest user left a space. |
Information | Guest operation | Guest login | login name: [login name of the guest user] | A guest user logged in. |
Information | Guest operation | Guest logout | login name: [login name of the guest user] | A guest user logged out. |
Information | Guest operation | Guest Email update | login name: [login name of the guest user], new login name: [login name of the guest user] | A guest user changed the e-mail address. |
Information | Guest operation | Guest password update | login name: [login name of the guest user] | A guest user changed the password. |
Information | Guest operation | Guest send email | login name: [login name of the guest user] | An e-mail for a guest user to reset the password was sent. |
Information | Guest operation | Guest reset password | login name: [login name of the guest user] | A guest user reset the password. |
*1: After the update on December 10, 2017, the same logs as those generated for standard users are generated.
*2: The Accessed section of the log details displays "127.0.0.1" regardless of the device on which the action was performed.
*3: For details, refer to the "Audit logs generated when a guest user's account is registered" section.
Kintone Administration
The table below describes audit logs that are generated when actions are performed on Kintone Administration.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Notice | System administration | Admit creation space | granted users: [[login name, department code, group code]], revoked users: [[login name, department code, or group code]] | The "Create Guest Spaces" permission was configured. |
Notice | System administration | Guest user two-step verification | enabled / disabled | The Guest Authentication setting was changed. |
Notice | System administration | New feature update | changes in design and layout of app settings screen disabled: {true/false}, changes in design and layout of plug-ins setting screen disabled: {true/false}, split acl transactions on deployment disabled: {true/false}, drag-and-drop reordering of attachments on new record screen and edit record screen disabled: {true/false}, new feature disabled by default: {true/false}, show multiple record import errors enabled: {true/false} | The Update Options setting was changed. |
Notice | System administration | Feature update | mail notification: {true/false} (include official api: {true/false}), space: {true/false}, allow create apps out of space: {true/false}, guest space: {true/false}, people: {true/false}, mail type: {text/html}, allow mail type personalization: {true/false}, mail personal setting:{none/mention} | The Feature Activation setting was changed. |
Notice | System administration | Mobile setting update | default view: [PC/MOBILE], user setting: [true/false] | The Default View for Mobile Browsers setting was changed. |
Information | System administration | App group delete | app group id: [app group ID], app group name: [app group name] | An app group was deleted. |
Information | System administration | Template import | (template id: [template ID], template name: [template name]), filename: [file name] | An app template was added via importing of an app template file. |
Information | System administration | Template export | (template id: [template ID], template name: [template name]), filename: [file name] | An app template was exported to a file. |
Information | System administration | Plug-in installed | plugin id: [plug-in ID], plugin name: [plug-in name] | A plug-in was installed. |
Information | System administration | Plug-in removed | plugin id: [plug-in ID], plugin name: [plug-in name] | A plug-in was uninstalled. |
Information | System administration | Plugin list export | filename: [file name] | The list of plug-ins was downloaded. |
Information | System administration | App list export | filename: [file name] | The list of apps was downloaded. |
Information | System administration | Space list export | filename: [file name] | The list of spaces was downloaded. |
Information | System administration | User usage list exported | filename: [file name] | The list of user access was downloaded. |
Information | Space template | Space Template import | name: [template name] | A space template was added via importing of a space template file. |
Information | Space template | Space Template export | name: [template name] | A space template was exported to a file. |
Information | Space template | Space Template delete | name: [template name] | A space template was deleted. |
Information | Guest management | Guest status update | login name: [login name of the guest user], status: [true/false] | A guest user's status (active/inactive) was changed. |
Information | Guest management | Delete guest | login name: [login name of the guest user] | A guest user was deleted. |
Inviting someone
The table below describes audit logs that are generated when actions to invite someone are performed.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Notice | System administration | Invite users | user names: [[comma-separated list of user names]], Emails: [[comma-separated list of e-mail addresses]] | An invitation(s) was sent via the user invitation dialog. |
Actions performed via API
The table below describes audit logs that are generated when actions are performed via API.
Level | Module | Action | Log details | Description of the action |
---|---|---|---|---|
Information | API operation | App create | app id: [app ID], app name: [app name] | The Add Preview App API was executed. |
Information | API operation | App deploy | app id: [comma-separated list of app IDs], revert: {true/false} | The Deploy App Settings API was executed. |
Information | API operation | App update | app id: [app ID], app name: [app name] |
The Update General Settings API was executed. |
Information | API operation | App permission update | Actual environment: app id: [app ID], app name: [app name] Test environment: app id: [app ID], app name: [app name], preview |
The Update App Permissions API was executed. |
Information | API operation | Form update | app id: [app ID], app name: [app name], field code: [comma-separated list of field codes] | The Add Form Fields API was executed. |
Information | API operation | Form update | app id: [app ID], app name: [app name], field code: [comma-separated list of field codes] | The Update Form Fields API was executed. |
Information | API operation | Form update | app id: [app ID], app name: [app name], field code: [comma-separated list of field codes] | The Delete Form Fields API was executed. |
Information | API operation | Form update | app id: [app ID], app name: [app name] | The Update Form Layout API was executed. |
Information | API operation | Field permission update | Actual environment: app id: [app ID], app name: [app name] Test environment: app id: [app ID], app name: [app name], preview |
The Update Field Permissions API was executed. |
Information | API operation | App view update | app id: [app ID], app name: [app name], views: [comma-separated list of existing views] | The Update Views API was executed. |
Information | API operation | App report update | app id: [app ID], app name: [app name], reports: [comma-separated list of existing graphs] | The Update Graph Settings API was executed. |
Information | API operation | App customize update | app id: [app ID], app name: [app name] | The Update Customization API was executed. |
Information | API operation | Record add | app id: [app ID], app name: [app name], record id: [record ID] | The Add Record API was executed. |
Information | API operation | Record add | app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs] | The Add Records API was executed. |
Information | API operation | Record update | app id: [app ID], app name: [app name], record id: [record ID] | The Update Record API was executed (using the record number as the key for the update). |
Information | API operation | Record update | app id: [app ID], app name: [app name], field: [field code], value: [key value] | The Update Record API was executed (using a value other than the record number as the key for the update). |
Information | API operation | Record update | app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs], record key: [comma-separated list of UpdateKey values] | The Update Records API was executed. |
Information | API operation | Record permission update | Actual environment: app id: [app ID], app name: [app name] Test environment: app id: [app ID], app name: [app name], preview |
The Update Record Permissions API was executed. |
Information | API operation | Record delete | app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs] | The Delete Records API was executed. |
Information | API operation | Record status update | app id: [app ID], app name: [app name], record id: [record ID] | The Update Status API was executed. |
Information | API operation | Record status update | app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs] | The Update Statuses API was executed. |
Information | API operation | Record comment add | app id: [app ID], app name: [app name], record id: [record ID], comment id: [comment ID] | The Add Comment API was executed. |
Information | API operation | Record comment delete | app id: [app ID], app name: [app name], record id: [record ID], comment id: [comment ID] | The Delete Comment API was executed. |
Information | API operation | Record comment get | app id: [app ID], app name: [app name], record id: [record ID], comment id: [comma-separated list of comment IDs] | The Get Comments API was executed. |
Information | API operation | Record assignees update | app id: [app ID], app name: [app name], record id: [record ID] | The Update Assignees API was executed. |
Information | API operation | Record file download | app id: [app ID], app name: [app name], record id: [record ID], filename: [file name] | The Download File API was executed. |
Information | API operation | Thread comment add | space id: [space ID], space name: [space name], thread id: [thread ID], thread name: [thread name], comment id: [comment ID] | The Add Thread Comment API was executed. |
Information | API operation | App status update | app id: [app ID], app name: [app name], enable: [Process Management availability], states: [list of status names after the update], actions: [list of action names after the update] | The Update Process Management Settings API was executed. |
Information | API operation | Space delete |
If the specified space ID did not exist, or if "Activate Spaces" in the Feature Activation setting in Kintone Administration was disabled: space id: [space ID] If there were no apps placed in the space: space id: [space ID], space name: [space name] If there were any apps placed in the space: space id: [space ID], space name: [space name], (app id: [app ID], app name: [app name]), (.... |
The Delete Space API was executed. |
Information | API operation | Guests delete | guest user code: [comma-separated list of e-mail addresses] | The Delete Guests API was executed. |
Information | API operation | Webhook notify |
If the notification was successfully sent: If the notification could not be sent due to an error attributable to Kintone: app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS}, server url: [destination server URL], error type: SERVER_ERROR, status code: [HTTP status code of the notification] |
A Webhook notification was sent via API. |
Information | API operation | Send slack dm |
If the notification was successfully sent: If the notification could not be sent due to an error attributable to Kintone: app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], error type: SERVER_ERROR, status code: [response status code from failed Slack API], error message: [error message] |
A Slack notification was sent via API. |
Information | API operation | Cursor create | app id: [app ID], app name: [app name] | The Add Cursor API was executed. |
Information | API operation | Notification update | app id: [app ID], app name: [app name] | An API to change the General Notifications, Per Record Notifications, or Reminder Notifications setting was executed. |
Information | API operation | App action update | app id: [app ID], app name: [app name], actions: [comma-separated list of existing app actions] | The Update Action Settings API was executed. |
Audit logs generated when a guest user's account is registered
Invitees can join a guest space to which they are invited by signing up in either of the following ways.
- Sign up using the invitee's own Kintone account (if the invitee is a Kintone user in a different domain)
- Sign up by registering a new guest account
When an invitee signs up with the invitee's own Kintone account, the action is logged as "Guest integrate account".
When an invitee signs up by registering a new guest account, the action is logged as "Guest sign up".
If an invitee signs up with the invitee's own Kintone account, no charge will be incurred for the invitee's guest account.