The Audit Log

The audit log in vWHM, filtered by action.

Audit Log (vWHM → Audit Log) is the record of privileged actions taken on this server. Every entry is written at the moment the action succeeds, from vWHM, from the REST API, or from the system itself.

If you resell hosting, this is the page that answers "who changed that, and when". It is also the page an auditor or a client dispute will send you to.

What an entry contains

Six columns:

• When — timestamp, to the second.
• Actor — a type badge and the name. The table allows four types (admin, account, api, system) but the panel writes only two today: admin, where the name is the vWHM username, and api, where it is token: followed by the token's label.
• Action — a dotted machine name such as account.suspend or package.update.
• Target — what was acted on, usually an account username, a package name or a domain.
• Detail — extra context where it exists, for example domain=example.com plan=Business on an account creation, or scopes=accounts:read,accounts:write on a token creation.
• IP — the client address the action came from.

Filtering and paging

Two filters, combinable:

• Action — a dropdown built from the distinct actions actually present in your log, so it only ever offers values that will return something.
• Actor contains — a substring match on the actor name, which works for both admin usernames and token labels.

Results are newest first, 50 per page, with Newer/Older links and a page count. The heading shows the total number of matching entries.

What gets recorded

The list below is what the panel writes today, grouped by area.

Accounts — account.create, account.suspend, account.unsuspend, account.terminate, account.terminate_2fa_fail, account.password, account.reset_password, account.plan, account.php, account.ssh, account.java, account.kafka, account.redis, account.https, account.setup_dns, account.import.

Packages — package.create, package.update, package.delete.

API tokens — token.create, token.revoke, token.delete.

Server and services — settings.update, serversetup.update, php.install, php.default, php.isolate_all, kafka.install, redis.install, mail.ssl_sync, mailqueue.purge.

Java apps — java.install, java.start, java.stop, java.restart, java.remove.

DNS — dns.provision, dns.autoprovision, dns.local_zone.

Databases — db.assign, dbreg.repair, dbreg.cleanup.

Backups — backup.schedule, backup.restore, backup.remote_restore, backup.dest_save.

Licensing and admin — license.activate, license.remove, admin.password_change.

Two entries are worth knowing about specifically, because they are the ones you look for after an incident:

• account.terminate_2fa_fail is written when someone typed the username correctly but gave a wrong or missing two-factor code on a termination. A row of these is somebody trying to delete an account without the second factor.
• admin.password_change is written on every successful admin password change, which also signs out every other admin session.

What it does not record

The log covers privileged changes, not reads. Viewing a page, listing accounts, or a successful GET through the API leaves no entry. Successful and failed sign-ins are tracked separately, in the sign-in history on vWHM → Security and in each account's own security page.

Actions that fail before they take effect are generally not written either. The exception is the termination two-factor failure above, which is recorded precisely because it is a security signal.

Retention

Entries are kept indefinitely. Nothing in the panel prunes the table, and there is no export button. On a busy server this table grows without bound, so if you need a retention policy, apply it yourself against the audit_log table in the panel's database — or dump the table periodically and keep the dump.

Auditing is deliberately best-effort in one direction only: if writing the log entry fails, the action it was recording still goes through. The panel will never refuse to suspend an account because it could not write a log line.