The Audit Log is OptimiDoc's central record of system events. Every authentication attempt, print spooler decision, device installation, and user-import action is written here with a timestamp, a severity level, and the user or device involved. When you need to answer "what happened on the server, when, and to whom", this is the first place to look.
How the Audit Log Works
Every significant action inside OptimiDoc is recorded as an event in a single server-side event log. Each event carries:
-
a timestamp,
-
a level that describes the nature of the event,
-
a source that identifies which subsystem raised it,
-
a free-text message, and
-
optional references to the user and device the event relates to.
The Audit Log page reads directly from this event store, so it reflects the live state of the system with no separate collection step. It is an administrator-only page.
Event levels
|
Level |
Meaning |
|---|---|
|
Start, Success, Fail |
Lifecycle of an operation — begun, completed successfully, or failed. Failed events are highlighted in red. |
|
Info, Warning, Error |
General informational, cautionary, and error messages. |
|
Update, Insert, Delete |
Data changes recorded during user import (records added, changed, or removed). |
Event sources
|
Source |
Raised by |
|---|---|
|
Authentication |
Log-ins and card reads at devices and in the web interface. |
|
Spooler |
Acceptance or rejection of incoming print jobs. |
|
Install |
Device installation and registration. |
|
Import |
Active Directory and CSV user synchronisation. |
Audit Log vs. Activity Log
OptimiDoc keeps two distinct logs, and it is important not to confuse them:
-
The Audit Log (under Diagnostics) records system and security events — authentication, spooler decisions, device installation, and user import, as described above.
-
The Activity Log (under Reports) records document operations — the individual print, copy, and scan operations that drive accounting and reporting, with page counts, colour breakdown, and cost.
Use the Audit Log to investigate who authenticated, whether a job was accepted, or whether an import ran. Use the Activity Log to review who printed or copied what, and how many pages.
Accessing the Audit Log
-
Log in to the OptimiDoc web interface as an administrator.
-
Navigate to Diagnostics > Audit Log in the left sidebar.
Reading the Event Table
The event table shows the most recent events first and lists the following columns:
|
Column |
Description |
|---|---|
|
Level |
A colour-coded icon; hover over it to see the level name. Failed events stand out in red. |
|
Time |
When the event occurred. Click the column header to sort oldest-first or newest-first. |
|
Source |
The subsystem that raised the event (Authentication, Spooler, Install, or Import). |
|
Message |
The event text. Long messages are truncated in the table — open the event to read the full text. |
|
User |
The associated user, or a dash if the event is not tied to a specific user. |
|
Device |
The associated device, or a dash if none. |
Click any row to open its detail panel, which slides in from the side and shows the full timestamp, level, source, user, device, and the complete message.
The table is paginated (25 events per page by default, adjustable), so filtering to the period of interest is the fastest way to find an event.
Filtering Events
Open the Filters panel at the top of the page to narrow the log. All filters combine, and the list refreshes as you change them:
|
Filter |
Behaviour |
|---|---|
|
From / To |
Date range. Defaults to the last 7 days. The two pickers constrain each other so the range always stays valid. |
|
Level |
Restrict to a single event level (for example, only Fail events). |
|
Source |
Restrict to a single source. |
|
Device |
Type to search for a device and show only its events. |
|
User |
Type to search for a user and show only their events. |
Use Clear Filters to reset everything back to the default 7-day window.
Quick Access from Other Pages
Several places in OptimiDoc link straight into the Audit Log with a device or user already selected. For example, opening the audit trail from a device's context takes you to this page pre-filtered to that device's events, saving you from setting the filter by hand. This makes the Audit Log a natural next step when a device or user is behaving unexpectedly.
Deleting Events
Each row has a delete action (trash icon). Deleting is intended for tidying up noise — for example, clearing out a burst of expected failures after a card-reader reconfiguration. A confirmation dialog warns that the action cannot be undone. Deletion is permanent, so treat the log as an audit record and remove entries only when you are certain they are no longer needed.
Related security view: The Unauthorised Accesses page is a focused view of this same event log — specifically the failed Authentication and Spooler events — with extra tools for turning an unrecognised credential into a user account.
In Summary
The Audit Log gives administrators a single, searchable timeline of everything the server considers noteworthy: authentications, spooler decisions, device installs, and import runs. Filter by date, level, source, device, or user to isolate an incident, open an event to read its full detail, and cross-reference document activity in the Activity Log when you need to see the print and copy operations behind it.
Related articles