Help center Core configuration Auditing & privacy Find and export account audit events Updated Wednesday, October 28, 2026 · Marcel Gravelle The audit log provides recorded account activity for operational investigation. Filters and exact references help narrow an incident without changing the underlying history. Applies to: Supportbench Core. Location: Settings → System tools → Audit log. Viewing requires the Access system logs. This is a read-only investigation page. Before you begin Write down the affected record ID, approximate incident time and action you need to investigate.Decide who may receive an exported copy. Audit records can include account and customer context. No settings save is required to search history. Find and verify audit evidence Open Settings → System tools → Audit log. Choose Event category: All categories, User, Case, Activity, Article, Queue or Admin.Choose relevant Events and, if known, the Agent who performed the action. The actor is not necessarily the affected record’s owner.Set a narrow Time frame and use Search all Audit Log columns for a known record reference. Use the Chat ID column filter when investigating a Chat.Choose Refresh to reload the recorded results. Inspect Event, Reference, Related, Actor, Occurred and identifiers together.If no result appears, use Clear to remove unintended filters, then widen the time frame deliberately. An empty filtered result is not proof that an action never happened.Choose Export when you need a copy of the available evidence. Preserve the filters, investigation purpose and relevant identifiers alongside the file. Settings reference Filters and evidenceSettingWhat it controlsHow to chooseEvent categoryAll categories or User, Case, Activity, Article, Queue and Admin.Start with the action’s likely entity.EventsOne or more event types within the selected context.Choose the specific action when known.AgentActor filter or All agents.Distinguish the person performing the action from the affected record.Time frameRecent windows from 30 minutes through 360 days.Choose a narrow window first, then widen if necessary.Search all Audit Log columnsA global search across audit evidence fields. Chat ID also has an explicit grid column filter.Use exact case, company, contact or event references.Clear / RefreshResets filters or reloads recorded events.Refresh after recent activity without assuming it changes retention.ExportExports the available audit evidence.Keep exported account information within the intended investigation audience.Event / Reference / Related / Actor / Occurred / Chat ID / IDsContext and identifiers for recorded actions.Correlate the audit ID and referenced record before drawing conclusions. Behavior to knowViewing and exporting history does not modify it. An empty filtered result is not proof that an action never occurred outside the selected window or retained history.This page is read-only. Search, refresh and export do not edit the recorded history. Recommended use Begin with the smallest useful time window and relax one filter at a time. This makes it easier to explain why a record appeared or disappeared.Keep record IDs with exported evidence; names can be similar or change later. Worked example A supervisor needs to understand an unexpected Case ownership change. Start with the exact Case ID and a narrow time window around the change.Choose Case and the relevant event; leave Agent broad initially so an unexpected actor is not filtered out.Read the event and related references, then compare with the Case’s own history.Export only the relevant investigation evidence for authorized colleagues. Treat a recorded action as evidence of that action, not an explanation of someone’s intent. Troubleshooting ProblemWhat to checkThe page is unavailableCheck the Access system logs.No events appearCheck Time frame, category, Events, Agent and text/column filters. Clear and widen deliberately.A recent action is missingRefresh and check the correct event category and record reference; compare the entity’s own history.The wrong agent appears in the rowDistinguish the actor who performed an action from the affected person or current owner.I cannot correct an audit rowThe log is read-only. Correct the underlying business record through its normal authorized workflow and retain the history. Related configuration Organization → Configure agent roles and division accessConfiguration → Configure workflows and automationWork a case from first response to resolutionManage escalations from first concern to accountable return Was this article helpful? Yes No Thank you for your feedback.