ANTE User ManualAudit Trail (This Company)
The Audit Trail is a read-only record of who changed what, and when, across every audited part of your company. It is an append-only history — entries are never edited, and they are kept for 24 months before being removed — so you can review activity, investigate a change, or confirm an action took place.
This is the company-scoped audit log: it shows only the activity that belongs to the company you are signed in to. (A separate cross-company view that spans every company on the installation lives in the Developer portal — see Audit Trail (All Companies).)
Overview
Every audited action in ANTE — a record being created, updated, deleted, or restored, plus key events such as logins, filing approvals, and exports — is captured as a single audit event. The Audit Trail page lets you browse those events for your company, narrow them down with filters, and open any event to see exactly what changed.
Each row answers four questions at a glance:
- When the action happened
- Who performed it — a person, or the system for automated events
- What was done, and in which module
- Which record it affected, with a one-line Details summary of what changed
When you open the page it shows activity from the last 7 days by default, with the newest events first.
Who Can View It
The Audit Trail is permission-controlled. You need the Audit Trail view permission to open the page. If you don't have it, the page shows a message explaining that you don't have permission to view the audit trail. Ask your administrator if you need access.
How to Open the Audit Trail
- Go to Settings → System Settings → Audit Trail.
- The page loads showing the most recent events from the last 7 days.
Page Layout
The page is a single table of audit events with a toolbar above it.
- Export CSV button (top right) — downloads the currently-filtered activity as a CSV file you can open in Excel. It respects the date range and every filter you have applied, so you can produce a maintenance-activity report for any period.
- Date range filter — two date pickers (a Start date and an End date) that set the time window for the events shown.
- Module and Action dropdowns — sit next to the date range on the toolbar. Both are searchable and clearable; use them to limit the list to one business area or one kind of action.
- Search box — searches event labels (for example, an employee name or a document number).
- More filters button — opens a dialog with the three less-frequently-used filters (Actor, Entity type, Entity id). A small number badge appears next to it when one or more of them is active.
- Column visibility / fullscreen controls — standard table tools to show or hide columns (for example, to turn on the hidden Device / IP column) and expand the table to fill the screen. Fullscreen remembers your choice for this table while you stay on the same browser tab, and resets to normal view once you exit fullscreen or open a new tab.
- Events table — the list of matching audit events.
- Newer / Older footer — page through the results (see Paging Through Results).
Table Columns
| Column | Description |
|---|---|
| Timestamp | The date and time the event occurred, newest first. Hover over it to see how long ago it happened. |
| User | Who performed the action: an avatar and the person's full name, with their username underneath. For a "Log in as this user" session the line underneath reads via <administrator>. Automated events show a robot icon and System. |
| Action | What was done, shown as a colored badge (for example, Created, Updated, Deleted, Login successful) with the module it belongs to (for example, HR, Payroll, Accounting) underneath. There is no separate Module column. |
| Record | What was affected — a readable label on the top line, with the record type and a shortened ID underneath. |
| Details | A one-line summary of the event. For an update with one changed field it reads like Email: old → new; with several it reads like Changed Email, Role +2 more. For sign-ins it shows the browser, system and IP address (for example, Chrome on macOS · IP). For other events it lists the key facts recorded with them (for example, a target username and an expiry time), and for created or deleted records it shows the record's code, name or status. |
| Device / IP | The browser and device, with the IP address underneath. This column is hidden by default — turn it on from the table's column visibility control. |
Action Badge Colors
The Action badge is color-coded so you can scan for important events quickly:
| Color | Meaning | Examples |
|---|---|---|
| Green (success) | A record was added or an action succeeded | Created, Restored, Login successful, Filing approved, Role granted |
| Red (error) | A record was removed, voided, or an action failed | Deleted, Login failed, Filing rejected, Role revoked, voided actions |
| Orange (warning) | A record was changed, or an exception worth looking at | Updated, Login from new device, Account locked, deactivated for inactivity, payroll submit blocked, any override |
| Blue (info) | Session events | Logged in as user, Returned from user, sandbox events, Login code sent |
| Grey (neutral) | Other events | Logged out, Password changed, Export generated, and similar |
Filtering Events
The Audit Trail can grow very large, so filters are the main way to find what you need. Filters apply immediately as you change them — the table updates live.
Date Range (on the toolbar)
Use the two date pickers in the toolbar to set a Start date and an End date. The defaults show the last 7 days. The end date is treated as the full day (everything that happened that day is included).
Search Label (on the toolbar)
Type into the search box to match against an event's display label — for example, an employee's name or a document number. This is a partial-text search, so you don't need the exact wording.
More Filters (in the dialog)
The Module and Action filters are dropdowns on the toolbar, next to the date range (both searchable and clearable). Click More filters to open a dialog with the remaining three:
| Filter | What it does |
|---|---|
| Actor | Limit to events performed by one account. Type to search for a person or account by name. |
| Entity type | The kind of record affected (for example, Employee or Purchase order). |
| Entity id | The exact identifier of a single record. This is an exact match. |
Filters in this dialog stay active after you close it. The dialog provides:
- Reset — clears the three filters in this dialog (Actor, Entity type, Entity id). It does not change the date range, Module or Action on the toolbar. Reset is only available when at least one of these filters is set.
- Done — closes the dialog. Your filters remain applied.
When any of these three filters is active, a small count badge appears next to the More filters button on the toolbar, so you don't forget that a hidden filter is narrowing the list.
If nothing matches, the table says No activity in this date range (widen the dates) when only the date range applies, or No events match these filters with a Reset Filters button when other filters are narrowing the list.
Modules You Can Filter By
| Module | Covers |
|---|---|
| Authentication | Logins, logouts, password changes |
| HR | Employee and HR records |
| Payroll | Payroll processing and payslips |
| Attendance | Timekeeping and attendance |
| Accounting | Accounting records |
| Treasury | Treasury and funds |
| Sales | Sales activity |
| Purchasing | Purchasing activity |
| Inventory | Inventory activity |
| Assets | Asset records |
| CRM | Customer relationship records |
| Project | Project records |
| Workflow | Workflow and approvals |
| Filing | Filings and approvals |
| Content | Content (CMS) records |
| Settings | Configuration changes |
| System | System-level events |
Actions You Can Filter By
The list below shows the common actions. The full list is longer (payroll journals, disbursements, recharges, biometric devices, statutory exemptions, timekeeping errors and more): the Action dropdown lists Created, Updated, Deleted and Restored first, then every other action alphabetically, and you can type to search it.
| Action | Meaning |
|---|---|
| Created | A new record was added |
| Updated | An existing record was changed |
| Deleted | A record was removed |
| Restored | A previously removed record was brought back |
| Login successful | A user signed in |
| Login failed | A sign-in attempt was rejected |
| Account locked | An account was temporarily locked after repeated failed sign-in attempts |
| Logged out | A user signed out |
| Password changed | An account password was changed |
| Filing approved | A filing was approved |
| Filing rejected | A filing was rejected |
| Export generated | A data export was produced |
| Role granted | A role was assigned |
| Role revoked | A role was removed |
| Timekeeping submitted for payroll | Timekeeping was sent to payroll |
| Payroll processing started | A payroll run began |
| Payslip released | A payslip was released |
| Employee terminated | An employee was terminated |
| Login from new device | A sign-in from a device not seen before for that account |
| Login code sent / Login code failed | A one-time sign-in code was sent, or a code check failed |
| Password reset requested / Password reset completed | A user asked to reset their password, or finished doing so |
| Sessions signed out | An account's active sessions were signed out |
| Logged in as user | An administrator started a "Log in as this user" session (actor is the administrator, entity is the user) |
| Returned from user | The administrator ended that session and went back to their own account |
Viewing Event Details
Click any row to open the Audit event dialog with the full detail of that event.
The dialog is wide, with a header card at the top showing:
- The action badge and its module, the record title, and the record's type and ID with a copy button
- by <Name> (<username>) and the date and time
- The same one-line Details summary shown in the table
- Two buttons: All Events for This Record filters the table to that record and clears the date range, so its full history shows; and All Events by <Name> filters the table to that user and keeps your date range
Below the header are these sections:
- Who and Where — the Actor; Signed in as this user by (when an administrator used Log in as this user); the IP address; the Device (browser, operating system and device type); the Request ID with a copy button; and the User agent behind a Show / Hide toggle.
- Details — the extra facts recorded with the event, as labelled values, with a View raw toggle that shows them as raw data.
Passwords, tokens, API keys and encryption keys are not displayed: they read Hidden in the dialog and are masked in the CSV export, including older entries.
When the event stored before-and-after snapshots, three tabs let you inspect what changed. Sign-ins and many named actions store none, so the tabs are not shown for them.
| Tab | What it shows |
|---|---|
| Changes | Each changed field with a readable name and its raw column name underneath, and the old value → new value. A count line reads like N changed · M unchanged. Fields that were not touched are never listed as removed. If nothing differs, the dialog says no field-level changes were detected. |
| Before | The full record as it was before the action. |
| After | The full record as it was after the action. |
The Changes tab opens by default.
When an administrator used Log in as this user (see Users), every action taken inside that session shows the user as the actor with via <administrator> under the name, and the event detail shows Signed in as this user by the administrator.
The automatic hourly "last active" stamp on accounts no longer creates Updated entries, so routine background activity does not clutter the list.
Paging Through Results
The footer below the table shows how many rows are currently displayed and provides two controls:
- ← Newer — go back to the previous (more recent) page of results.
- Older → — load the next (older) page of results.
A control is disabled when there is no page to move to in that direction, or while a page is loading. Changing any filter starts you back at the first (most recent) page.
Common Tasks
Find Out Who Changed a Specific Record
- Open Settings → System Settings → Audit Trail.
- If the change is older than a week, widen the date range in the toolbar.
- Click More filters.
- Set Entity type to the kind of record (for example, Employee), and optionally paste the record's Entity id for an exact match.
- Click Done.
- Review the matching events — the User column shows who made each change.
- Click a row to see the Changes tab of exactly what changed. Or open any event and click All Events for This Record to see that record's full history in one step.
Review One Person's Activity
- Open the Audit Trail.
- Set the date range you want to review.
- Click More filters, then in the Actor field type the person's name and select their account.
- Click Done.
- The table now shows only events performed by that account.
- Shortcut: open any event by that person and click All Events by <Name>.
Investigate Failed Logins
- Open the Audit Trail and set the date range to cover the period in question.
- On the toolbar, set Module to Authentication and Action to Login failed.
- Review the results — the Details column shows the browser and IP address for the attempt, and the detail dialog's Who and Where section has the full device information, when available.
See Exactly What Changed in an Update
- Find the Updated event you're interested in (set the toolbar's Action dropdown to Updated if helpful; the Details column already summarises the change).
- Click the row to open the Audit event dialog.
- Stay on the Changes tab to see each changed field with its old and new value.
- Switch to Before or After to see the complete record state at each point in time.
Tips
- Start with the date range. The list only shows the last 7 days by default, so widen the range before assuming an event is missing.
- Watch the filter badge. The number next to More filters tells you hidden filters are still narrowing the list — clear them with Reset if results look incomplete, and check the Module and Action dropdowns on the toolbar too.
- Read the Details column first. It often answers "what changed?" without opening the event; the Changes tab then hides everything that didn't change.
- Append-only. The audit trail can't be edited from this page — it is a permanent record, which is exactly what makes it useful for reviews and investigations.
Related Pages
- Audit Trail (All Companies) — the Developer-portal view of the same activity, spanning every company on the installation
- Roles — manage roles and permissions, including who can view the Audit Trail
💡 Note: The Audit Trail is a read-only, append-only history scoped to your company. Use it to answer "who did this, and when?" — it doesn't let you undo or change anything, only review what happened.