Log Types
Choose a log by the event you need to establish and the level of detail you need. An action history, a request, a workflow run, and a delivery attempt describe different stages. Correlate them using the recorded time, account, path, run, or request identifier where available; a success at one stage does not establish completion of a later one.
Choose the Evidence
| Question | Source | What to examine |
|---|---|---|
| Who accessed or changed a file? | Activity History | Recorded actions, paths, interfaces, and the user when associated with the action. Folder and User Activity are views of this same history. |
| Who changed access or configuration? | Settings Changes | The administrator, affected resource, and recorded change. |
| Why did a login, directory sync, or account lockout occur? | Identity & Account Events | SSO provider events, LDAP synchronization results, and lockouts. |
| Did a client connect and complete a request? | Protocol & API Logs | Individual requests, protocol results, errors, and identifiers. |
| Did a workflow run, and which remote operations succeeded? | Remote Server & Workflow Logs | The overall run, its file events, and corresponding Remote Server actions. |
| Why is a file held during processing? | File Processing Failures | Failed folder processing and associated errors. |
| Was an email accepted or sent? | Email Logs | Inbound Inbox processing or outbound submission, suppression, and failure. |
| Did an HTTP notification reach its destination? | Webhook Logs | The request and the destination's response, within the viewer's permitted scope. |
| Did an external contact use a Share Link or Inbox? | Sharing & Inbox Activity | Access, upload, and registration records for the selected resource. |
| What happened to a public hosting request? | Public Hosting Logs | The requested path and HTTP response; a successful response does not establish a completed download. |
| What did a scripted CLI operation do? | CLI Run Logs | Operation logs uploaded by the CLI when configured to send them to the site. |
Feature-specific records retain their own context. AI Chat Logs hold Assistant and AI Task transcripts, SCIM activity records provisioning, and Event Channel Delivery Attempts track delivery of operational notifications. Use Usage for site-wide resource consumption.
Logs Available for Ongoing Delivery
SIEM Integrations and Log File Streaming deliver the following categories of audit and activity logs. Select the categories required by your receiving system. A record being available in the web app or a feature history does not by itself make it one of these forwarding categories.
| Log Type | Details | Links for API and Sample Logs |
|---|---|---|
| Settings Changes | Administrative changes to site settings, folder configuration, accounts, credentials, and access. | Settings Changes Logs |
| History Logs | Audit logs of changes made to site files, users, groups, logins, permissions, and API keys. | History Logs |
| File Transfer Services | FTP, SFTP, and WebDAV file transfer activity. | FTP Action logs SFTP Action logs WebDAV Action logs |
| Remote Server and Sync actions | The Integrations selection covers actions on Remote Servers, Syncs, and the Files.com Agent. | Outbound Connections logs , Sync logs |
| Automations logs | Actions performed by your automations and their results. | Automations logs |
| API Requests logs | Audit log of API requests made to your site. | API Requests logs |
| Outbound Emails logs | Audit log of email notifications sent by the server. | Outbound Emails logs |
| Public Hosting logs | Audit log of all requests to access your publicly served folders. | Public Hosting logs |
| ExaVault API Requests logs (Legacy) | Audit log of ExaVault API requests made to your site. | ExaVault API Requests logs |
For setup and delivery behavior, use SIEM Integrations or Log File Streaming. Retention differs between sources and delivered copies; use Log & Record Retention when planning collection.