Carousel Cloud Audit Logs

Description

The Audit Log is a record of who did what and when across your Carousel Cloud server. It records logins, content changes, permission changes, player changes, and other key actions. Use it to answer questions like "who deleted that zone?", "what changed on this bulletin yesterday afternoon?", or "how often are people actually logging in?"

Requirements and Additional Information

• Role: You must be a Site Administrator to view the Audit Log page. Other user permissions/roles can not see or view the Audit Log page

  • To view the Audit Log, navigate to Configure > System > Audit Log

• Subscription: As shown below, your log retention time is displayed near the top of the Audit Log page and is based on your Carousel Cloud subscription

  • Pricing Plans - All Functionality and Features

• Events take up to 5 minutes to appear in the Audit Log. Audit events are processed in the background, so an action you just performed won't show up immediately. If you're verifying something you just did, wait a few minutes and search again.

• Events are kept for a limited time. You can't search further back than your log retention time, and the date selectors won't let you try.

The Audit Log Page

When you open the Audit Log page, you will see the most recent events from the last 24 hours. From there, you can narrow or widen the search with the filters at the top:

• Event Type — a multi-select list of every recorded action, organized into five groups: User & Session, Content, Configuration, Players, and Emergency Alerts. Check a group's header to select the whole group at once, or pick individual event types. Leave it empty to search all event types.

• Date Range — presets for Last 24 Hours, Last 7 Days, Last 30 Days, Last 90 Days, and Last Year, plus Custom Range, which reveals Start Date and End Date pickers. The end date is inclusive — a range of July 1 to July 1 returns everything that happened on July 1. Presets longer than your retention period are hidden.

• Actor — search by the name or email of the person (or API client, player, or system process) that performed the action. Partial matches work: searching john doe finds john.doe@example.com.

• Object — search by the name of the thing that was acted on: a bulletin's description, a zone name, a media file name, a player name, and so on.

Click Apply Filters to run the search, or Reset Filters to return to the default last-24-hours view.

Reading the results

Results appear in order of newest first, in a table with these columns:

The table shows 50 events per page. A single search returns up to 2,000 events; if more match, the page tells you the total and offers a Load More button to fetch the next batch. For very large result sets, exporting to CSV is usually more practical than paging through on-screen.

The table shows what happened; the CSV shows what changed. For update events, the before-and-after values of changed fields are included only in the CSV export — so when you need to know exactly what was modified, export.

Exporting to CSV

Click Export CSV to download everything that matches your current filters as a single file (named similar to carousel_audit_log_2026-07-15.csv). There is no row limit — the export includes all matching events, not just the ones loaded on screen. The button is disabled until you've applied your filters and there is at least one result.

The CSV contains more detail than the on-screen table:

Importing the CSV into a spreadsheet

The file is a standard comma-separated UTF-8 file, so any spreadsheet program can open it:

• Microsoft Excel: Double-click the file, or use File > Open. Names with accents and other special characters display correctly. If you want Excel to treat the timestamp column as a real date/time (for sorting or charting), select the column and apply a date format, or import via Data > From Text/CSV, which detects it automatically.

• Google Sheets: In a blank sheet, choose File > Import > Upload, select the file, and keep the default settings (separator type: detect automatically).

• Apple Numbers: Double-click the file or drag it onto the Numbers icon.

Once imported, the data works well with standard spreadsheet tools — sort by any column, filter with your spreadsheet's filter feature, or build a pivot table (for example, count of user.login events per actor per week).

Common Use Cases

Investigating an incident ("what happened this morning?")

When something unexpected shows on your displays and you need to reconstruct events:

1. Set Date Range to a window around the incident (use Custom Range for a specific day).

2. Leave Event Type empty so nothing is filtered out.

3. Click Apply Filters and scan the results around the relevant time — the table is sorted newest-first, and every row tells you who, what, and from where.

4. Once you spot the relevant change, narrow the search: filter by that actor or object to see everything else they touched.

For emergency-messaging incidents specifically, select the Emergency Alerts group plus the Content group's alert.* events. This shows when CAP alerting was enabled or disabled, each CAP alert received from your alerting authority, and every alert bulletin created, changed, approved, or removed.

Finding out what changed a specific bulletin at a certain time

1. In Event Type, select bulletin.updated (and alert.updated, if the bulletin lives in an alert zone).

2. In Object, enter the bulletin's description (what it's called in the bulletin list) — partial text is fine.

3. Set the Date Range around the time in question and click Apply Filters.

4. The matching rows show who made each change and when. To see exactly which fields changed and their before/after values, click Export CSV and check the previousstate and newstate columns.

Note that changes to a bulletin's content blocks (the text and images inside it) are recorded as an update event, but without field-level before/after detail.

Finding out who deleted something

1. In Event Type, select the relevant deletion event — zone.deleted, bulletin.deleted, media.deleted, template.deleted, player.removed, user.deleted, and so on.

2. If you know the name of what was deleted, enter it in Object; otherwise widen the Date Range to when you think it disappeared.

3. Click Apply Filters. Each row shows who performed the deletion, when, and from what IP address.

Because deletions are one of the most common things to investigate, a practical habit is to periodically export all *.deleted events for the past month as a CSV and keep it with your records.

Reviewing sign-in activity and usage patterns

To see who is using Carousel and how often:

1. In Event Type, select user.login under User & Session. Optionally add user.login_failed (each failed attempt records whether it was a wrong password or a locked-out account) and user.logout.

2. Set a long Date Range — Last 90 Days or Last Year.

3. Click Apply Filters, then Export CSV (a long range can return far more than fits comfortably on screen).

4. In your spreadsheet, build a pivot table with actor as rows and the count of events as values to see logins per person, or group the timestamp by week or month to see usage trends over time.

Each login event also records the sign-in method (Password, MFA, Passkey, or SSO) — useful for tracking adoption after rolling out SSO or multi-factor authentication.

A couple of details to be aware of when reading login data:

• A logout event is recorded when a user deliberately signs out. Sessions that end because the user was idle are not recorded as logouts.

• Signing in on a trusted device that skips the MFA prompt is recorded with the method Password.

What Gets Recorded?

• Every event captures the actor, the action, the object acted on, the timestamp, the originating IP address (with country where determinable), and — for updates — which fields changed.

• Sensitive values are never written to the log: passwords, CAP tokens, webhook URLs, and SSO credentials are excluded from event details even when the related setting changes.

• As new features get added to Carousel Cloud, new event types may be added to the audit log

Frequently Asked Questions

Why can't I find an event for something I just did?
Events take up to 5 minutes to appear. Also, check that the action is in the recorded list above — not every action in Carousel Cloud is audited.

Are audit events from other Carousel Cloud customers visible to me?
No. The Audit Log only ever contains events from your own Carousel Cloud server.

Can audit entries be edited or deleted?
No. Audit records are write-once; they cannot be modified or removed through Carousel Cloud, and they expire automatically at the end of your retention period.