Operation Logs Overview

Operation logs give you an audit trail of the successful actions taken on your Cloud Voice system. Use them to review activity, trace configuration changes, and pin down the source of unexpected behavior.

What operation logs capture

Each entry records a completed operation and answers four questions, so you can narrow a search from any angle:

• Who performed it. Look at every user’s activity, or filter down to the administrator or a single extension.
• When it happened. Filter by date and time.
• What was done. See the specific action that was carried out.
• Where it applied. Filter by the module the action affected.

Where operation logs are stored

Operation logs are kept in a fixed default storage area. This location cannot be changed.

Automatic cleanup

To keep storage in check, the system removes the oldest entries automatically once the operation log reaches 50,000 records. You can raise or lower that threshold, or instead cap how many days entries are kept. See Auto Cleanup Settings for the full set of options.

Tip

Set the threshold or retention window with your audit needs in mind. If you lower it too far, older entries get deleted sooner, and you may lose the history you would need to trace a configuration change or investigate a security event after the fact.

Note

A small set of entries tied to system security and user privacy is always preserved, even during cleanup. Keeping these records available means support can still investigate if your system is targeted by toll fraud or an attack.

The following operations are never removed by automatic cleanup:

Event type	Event
Operation	Administrator Login Success
Operation	Administrator Password Changed
Operation	Web User Login Success
Operation	Web User Login Failed
Operation	Cloud Voice App Login Failed
Operation	Extension User Password Changed
Telephony	Emergency Call Dialed Out
System	Cloud Voice SMTP Server Error
Security	Web User Locked Out
Security	Cloud Voice App User Blocked Out
Security	Extension Registration Blocked Out
Security	Auto Defense IP Blocked Out
Security	Outbound Call Frequency Exceeded
Security	Outbound Call to a Disallowed Country

In the table above, SMTP (Simple Mail Transfer Protocol) is the email service the system uses to send notifications, so a Cloud Voice SMTP Server Error entry means an outgoing email attempt failed.