🛡️ Security Log
A day-by-day record of every sign-in attempt — who, when, from which IP.
The Security Log (under Activity Logs, admin-only) is a dedicated authentication audit: every sign-in — successful or refused — is written to a per-day file with the time, the username, how they signed in (company SSO or the built-in superuser), the result, and the client IP address (resolved through the forwarded-header chain, so it stays correct behind a proxy or CDN).
What you can do here
- Pick a day to review its sign-in events.
- See the IP address for each event, with an optional reverse-DNS name where one resolves (a slow lookup can never hold up the page).
- Spot refused sign-ins — e.g. a disabled account trying to get in, or repeated failures from one address.
Note This log is deliberately stricter than the app’s other pages: only an administrator (and the built-in superuser) can open it. Files are kept for a fixed retention window and then rotated out automatically.