# The Logs manual

<!-- module: s10-logs · deck: Every change is in the audit log, with who made it and how; every sign-in in the sign-in log; each log is purged by date every night, its age a setting, and every export is recorded. -->

**Table of contents · 24 October 2026 · S10 of plan CORE. Since S11 the file access log is purged the same way (the Files manual); the
operations page that shows the purges beside the queues and the schedule with S13.**

Atrium keeps three logs. The **audit log** holds every change: who made it, how (a page, the API, the system),
what changed, before and after. The **sign-in log** holds sign-ins and security events. The **e-mail log** (the Mail
manual) holds every e-mail. None of them can be edited, not even by the database; they leave only by date, every
night, each by its age.

The one sentence to carry through it: **a log is never edited, only purged by date, and every export of one is itself
in the audit log.**

**Who meets what**

| Seat | Who | What they do here |
|---|---|---|
| Owner, Admin | Whoever may read the workspace's audit log (`audit.view`) and export it (`audit.export`) | Reads the workspace's changes, opens one, exports a period; sets how long the workspace keeps its changes and its mail (`setting.manage`) |
| Service | The platform's owner | Reads every workspace's changes and the sign-in log, sees the purges and runs one, sets each log's age for the platform |
| Operator | Whoever runs the server | Purges a log to a day by hand (`logs:purge --before`) |

**As shipped**

| Log | Kept for | A workspace may change it | Least · most |
|---|---|---|---|
| Audit log | 730 days | Yes | 365 · 3,650 days |
| E-mail log | 365 days | Yes | 30 · 1,095 days |
| Sign-in log | 365 days | No (it belongs to no workspace) | 90 · 1,095 days |
| An export's link | 7 days | No | 1 · 30 days |

Every night at 02:30 each log loses what is older than its age, archived first.

---

## Part 1 · The logs

- [1.1 Reading the audit log](p01-logs.md#11-reading-the-audit-log)
- [1.2 Exporting the audit log](p01-logs.md#12-exporting-the-audit-log)
- [1.3 Reading the sign-in log (Service)](p01-logs.md#13-reading-the-sign-in-log-service)
- [1.4 Choosing how long the logs are kept](p01-logs.md#14-choosing-how-long-the-logs-are-kept)
- [1.5 Purging now (Service)](p01-logs.md#15-purging-now-service)
- [1.6 Purging to a day by hand (operator)](p01-logs.md#16-purging-to-a-day-by-hand-operator)