History Logs record file and folder activity across your Files.com site. Each entry answers the questions administrators and auditors ask most often: who uploaded a file, who downloaded a sensitive document, who deleted a missing file, who renamed or moved content, and when a file was last accessed.

Administrators rely on History Logs to investigate suspicious activity, troubleshoot user-reported issues like missing or unexpectedly modified files, verify how share links and Inboxes are being used, reconstruct the sequence of events around a file or folder, and meet compliance requirements that depend on file-level evidence.

Each entry records the user who performed the action, the action itself, the timestamp, the location, and the resulting file change. Recorded events include uploads, downloads, reads, updates, deletions, moves, copies, and renames.

Files.com retains History Logs for seven years from the action's timestamp. The Folder Activity and User Activity views use the same history and retention period. Generated exports have a separate 30-day lifetime.

Actions

History Logs record actions related to files, folders, users, groups, folder permissions, API keys, and login activity. Each entry represents a confirmed action that reflects verified access or a change on the site. History Logs capture meaningful audit events rather than every individual request.

History Logs record successful login events because they represent verified access to the site. Login failures do not represent a completed action and do not appear in History Logs or User Activity views. API logs record login failures along with every individual API request made to the platform.

File and Folder Actions

History Logs record actions that reflect how users access and change files and folders on the site. These actions capture common file operations including downloads, uploads, updates, deletions, copies, and moves. The table below describes the file and folder actions recorded in History Logs.

Files and Folders Actions Type	Details
Read	Downloads and file previews.
Created	Uploads, creation of new folders, or files.
Updated	Changes made to the content of files, including the overwriting of existing files.
Deleted	Deletes, including automatic expiry of files.
Copied	File copy operations.
Moved	File move operations, including file or folder renames.

User, Group, Permission, and API Key Actions

History Logs record administrative actions related to user accounts, groups, folder permissions, and API keys. These entries capture creation, updates, and deletion events for users, Groups, and API keys, along with folder permission grants and removals.

Settings Changes is the primary audit trail for administrative configuration, permissions, user and Group administration, and API keys. Use it when investigating an administrative change; History also records the account and access actions listed below.

Action Type	Details
Login	Successful login to the site.
User created	Creation of a user account.
User updated	Changes made to an existing user account.
User deleted	Deletion of a user account.
Group created	Creation of a group.
Group updated	Changes made to an existing group.
Group deleted	Deletion of a group.
Permission created	A folder permission granted to a user or group.
Permission deleted	A folder permission removed from a user or group.
API key created	Creation of an API key.
API key updated	Changes made to an existing API key.
API key deleted	Deletion of an API key.

When a new permission replaces narrower permissions for the same user, group, or Partner, History Logs record the new broader grant. Files.com removes the redundant permission records as part of that grant and does not create a separate Permission deleted entry for each one.

Copy, Move, and Rename Actions

When files or folders are copied, Files.com treats each copied file as a newly created item on the site. Because each file represents a new object, the system logs a separate copy event for every file and subfolder involved. This results in detailed, file level history entries for copy operations.

When files or folders are renamed, Files.com records the action as a move. A rename changes the item's path, even when the item remains in the same folder, so the system logs the rename as a move event.

When a folder that contains files is moved into another folder, Files.com treats the action as a change to the folder's location rather than the creation of new items. The system logs a single move event for the parent folder without logging separate move events for each item inside it. On Files Native Storage, the paths of those files and subfolders update in the background, so the folder's move event does not confirm that every contained path has been updated. When files are moved individually, Files.com logs each move as a separate action because each file location change occurs as its own operation.

Because a folder move does not create file level history entries, features that rely on file activity do not run during this operation. This includes email notifications, file-triggered automations, and webhooks. For example, moving a folder that contains uploaded reports does not trigger upload alerts, since the system does not record individual file events during the folder move.

How History Logs Consolidate Repeated Actions

History Logs summarize activity to provide a clear and useful audit trail. They consolidate certain repeated actions to prevent high frequency workflows from overwhelming the log and to highlight meaningful activity.

Read and Update Actions

History Logs consolidate repeated Read and Updated actions that occur within a 15 minute window when the same user performs the same action on the same file from the same IP address using the same interface. When a user downloads, previews, or updates the same file multiple times within this window, History Logs record a single entry for that activity instead of separate entries for each occurrence.

Files.com uses this consolidation to keep History Logs clear and usable for real world workflows. Many file transfer processes upload files in small pieces, which produces a series of updates while a file grows. Other processes repeatedly download the same file to check for changes, which produces many read actions in a short period. Without consolidation, these patterns would flood the History view with repetitive entries that do not provide additional insight.

History Logs provide a summarized view of Read and Update activity, while API logs record every individual API request for those operations.

History Logs record successful logins to the site, capturing the user who signed in and the timestamp of the login. For protocols including FTP, SFTP, and WebDAV, clients often reconnect multiple times during a single user action, which generates multiple successful login events from the same IP address and protocol. History Logs consolidate these repeated successful logins into a single entry within a short time window to keep the log readable.

Login failures do not appear in History Logs or User Activity views. API logs record login failures along with every individual API request made to Files.com.

Activity Across Sites

Guest file and folder actions on the Host's files through Connected Sites are recorded in both sites. The Guest's History uses the _/Sites/<host-site-id>/... path, while the Host's History uses its own file or folder path. This includes actions initiated by Guest Site Administrators, other permitted Guest users, and workflows on the Guest site. Filter each site's History using the path shown on that site.

Each site's notifications, webhooks, and Automations use the record on that site and respond when their configured paths, triggers, and conditions match. Both organizations can audit the exchange and run their own followup processing.

When another Files.com site uses your site's API key through a native Files.com Remote Server, file actions are recorded on your site. A user API key attributes those actions to its owning user; a site-wide key has no owning user. These native operations do not create login events or API request entries on the site that issued the key. The mounting Site also records file activity at its mount paths. Review each Site's History by its own file or folder path, and the key owner's identity on the Site that issued the key.

Parent Site operations on Child Site files through the underscore folder are also recorded in both sites. The Parent Site uses the _/Sites/<child-site-id>/... path, while the Child Site uses its own file or folder path. Activity performed directly within a Child Site is recorded there only. Each site's matching notifications, webhooks, and Automations respond to its own record; Automation and Sync run logs remain in the site where the workflow is configured.

A Partner Channel Route Path records activity at the Channel path. Its notifications, Event Channels, and Automations match that path rather than requiring a rule on the target. Access Across Sites and Storage compares History with the permissions and file rules governing each connection.

Filters

You can apply filters to narrow down your log view. For example, you can filter the logs to display only certain actions performed by a specific user on a particular date, or limit the results to a specific IP address. The available filter options are Start Date and End Date, Action, User, Folder Path, File Path, IP, and Interface.

The File Path filter returns activity at the exact path you enter. Folder Path returns the selected folder's history, including changes to its direct subfolders. It does not include activity inside those subfolders. To include a folder and all its subfolders, append /* to the path. For example, path/to/folder/* returns history for that folder and everything beneath it.

You can also use wildcards to match file or folder names when the exact path is unknown. For example, *Invoice*.txt filters any .txt file whose name contains 'Invoice'.

Folder History

To view the history for a particular folder, you can either filter the History logs by Folder Path or navigate directly to that folder from All Files and click the File history button.

A folder's history includes actions on files directly inside it and changes to the subfolders directly inside it, including their creation, updates, deletion, moves, and copies. These entries record changes to the parent folder's contents and show the subfolder's name, the recorded user, and the time.

History permission on the parent folder includes these entries even when the grant is non-recursive and the viewer has no permission on the subfolder. Activity inside a subfolder belongs to that subfolder's own history. To include it in a site History search, append /* to the Folder Path.

File History

To view the history for a single file, you can either filter the History logs by File Path or, from the file browser, click on the ellipsis (...) button in the Actions column and select History. Here, you will see the file's actions within the retention period.

User History

The User Activity view shows actions performed by the selected user, along with account-related changes made to that user by an administrator. It uses the same History records, consolidation rules, and seven-year retention period as the site-wide and folder views. Login failures remain in API Logs, not User Activity.

To view the activity log for an individual user, you can either filter the History logs by User or navigate to User Accounts, select the user, edit their settings, and then choose the History tab. Here, you will see the user's actions within the retention period.

Exporting History

You can export the audit logs by clicking the Export button on the History page, or export the same logs directly from your File browser by clicking Export history.

History CSV exports preserve values exactly as recorded, including file and folder names. This applies to Folder, File, and User History exports. Files.com does not add a leading apostrophe to values beginning with =, +, -, or @. For example, a folder named =reports remains =reports in the exported value. A spreadsheet application may interpret such a value as a formula when you open the CSV. Notification exports, table exports, and built-in reports preserve text in the same way.

When reviewing these exports in a spreadsheet, use its CSV import options and set columns containing text values, such as names and paths, to text before loading the data. This keeps the recorded names available for audit review. Excel and LibreOffice Calc provide controls for choosing column types during import.

A History export and its generated CSV are retained for 30 days from the export's creation. Removing the export does not remove the underlying History Logs, which follow their seven-year retention period. A new export can retrieve history that remains within that period.

Exporting User Activity History

You can download the activity log history for a specific user or for all the users on your site.

To download the activity log for a specific user, navigate to User Accounts, select the user, edit their settings, and then choose the History tab. Click the Export button.

To download the user login activity log for all the users on your site, go to the users page by typing "Manage Users" in the search box at the top of every page, and then clicking on the first result. Click the Export login history button to start the download. Select a starting and ending date range and the file format for the exported history.

All types of exported history files have fields for When, Who, What, IP, and Interface information. These fields can be searched and filtered in your spreadsheet application.

Details Recorded in History Logs

Each history log entry includes the following information.

Column Name	Details
Date	The date and time the action occurred, displayed in the time zone of the current user.
User	The user who performed the action. The field appears blank when the action has no associated site user, including when an external user uploads files to an inbox or downloads files from a share link. The username appears in italics if the user account was deleted.
Action	The action recorded in the History Log entry (for example, login, file read, file created, file updated, user created).
Description	The description of the action that was taken, and the file or folder or the user the action was taken on.
File Path	Full path of the file in case the action taken was on a file.
Folder Path	Full path of the folder in case the action taken was on a file or folder.
Action Source	Full path of the folder in case the action taken was a Move or Copy.
Action Destination	Full path of the folder in case the action taken was a Move or Copy.
Failure Type	Details of the failure in case there was a failure with the action and the reason is known.
IP	The IP address that the user connected from when performing this action.
Interface	The interface used by the user to perform the action (e.g., web, API, FTP, SFTP, AS2, email, desktop, mobile, office, remote, SCIM, WebDAV, JS API, Robot).

Unauthenticated Activity

When a file action has no associated site user, the History Logs do not display a user. This happens when files are downloaded through a share link or uploaded to an Inbox. In these cases, the user field appears blank because the action did not occur under an authenticated site user.

Deleted User Accounts

History Logs preserve the original username on every entry, even after the user account is deleted from the site. If a user performs file or folder activity and that account is later removed, the log continues to show the original username on those historical entries but displays it in italics. The italics indicate that the user account no longer exists, allowing administrators to see who performed each action while recognizing that the account has since been deleted.

Interface as Robot in Logs

If you see a history entry with Interface listed as Robot, that means that the file action was performed by an Automation or File Expiration behavior (folder setting) configured on your Site.