# Operation Logs Overview

Operation logs give you an audit trail of the successful actions taken on your Cloud Voice system. Use them to review activity, trace configuration changes, and pin down the source of unexpected behavior.

## What operation logs capture

Each entry records a completed operation and answers four questions, so you can narrow a search from any angle:

- **Who** performed it. Look at every user's activity, or filter down to the administrator or a single extension.
- **When** it happened. Filter by date and time.
- **What** was done. See the specific action that was carried out.
- **Where** it applied. Filter by the module the action affected.

## Where operation logs are stored

Operation logs are kept in a fixed default storage area. This location cannot be changed.

## Automatic cleanup

To keep storage in check, the system removes the oldest entries automatically once the operation log reaches 50,000 records. You can raise or lower that threshold, or instead cap how many days entries are kept. See [Auto Cleanup Settings](/pbx/administrator-guide/auto-cleanup-settings/) for the full set of options.

:::tip
Set the threshold or retention window with your audit needs in mind. If you lower it too far, older entries get deleted sooner, and you may lose the history you would need to trace a configuration change or investigate a security event after the fact.
:::

:::note
A small set of entries tied to system security and user privacy is always preserved, even during cleanup. Keeping these records available means support can still investigate if your system is targeted by toll fraud or an attack.
:::

The following operations are never removed by automatic cleanup:

| Event type | Event |
| --- | --- |
| Operation | Administrator Login Success |
| Operation | Administrator Password Changed |
| Operation | Web User Login Success |
| Operation | Web User Login Failed |
| Operation | Cloud Voice App Login Failed |
| Operation | Extension User Password Changed |
| Telephony | Emergency Call Dialed Out |
| System | Cloud Voice SMTP Server Error |
| Security | Web User Locked Out |
| Security | Cloud Voice App User Blocked Out |
| Security | Extension Registration Blocked Out |
| Security | Auto Defense IP Blocked Out |
| Security | Outbound Call Frequency Exceeded |
| Security | Outbound Call to a Disallowed Country |

In the table above, SMTP (Simple Mail Transfer Protocol) is the email service the system uses to send notifications, so a Cloud Voice SMTP Server Error entry means an outgoing email attempt failed.