# Audit log views

The listing and the message flow diagram, and how to read each of them.

The audit log has two main screens - the listing and the message flow.

## The listing {#the-listing}

`Monitoring` -> `Audit log` in Dashboard, or the `Audit log` link on any channel's or connection's own row, which opens it filtered to that one object.

The listing is the main screen: a list of events on the left, the selected event's detail on the right, and the source and object filters at the top.

![The audit log listing](https://zatosource-production.b-cdn.net/docs/gfx/audit-log/listing.webp?v=1789221715)

Dashboard menu: Monitoring > Audit log

Filtering:

- **Source and object.** Two pickers, and each can select things either in or out. Picking out is how you say "everything except", for instance every source except log access when configuration changes are drowning out the traffic.
- **Search.** Free text across the payload, the event type, the message ID, the correlation ID, the endpoint, the status, the classification, the external client ID and the subscription key. For sources that have identifiers of their own - a patient identifier on an HL7 message, for example - searching for one returns the whole exchange it appears in, not just the single event that mentions it.
- **Outcome.** Only the outcomes the current source can actually report, so pub/sub offers `expired` and the scheduler offers `running` and `timeout`.
- **Event type.** Click an event type on any row to filter down to it.
- **Time range.** From the last five minutes to everything, and the page can refresh itself while you watch.
- **Outstanding.** For the sources that pair a message with an acknowledgement, this shows the exchanges whose acknowledgment has not arrived, oldest first.

Each event shows its correlation ID, status, classification, endpoint, duration and size. Values link to where they lead - a channel's endpoint to the service, an object to its own configuration page, a scheduler run to that run's detail.

### The activity strip {#the-activity-strip}

The band above the list shows whatever the filters currently match as a histogram of counts over time, colored by outcome. A burst of errors is visible without scrolling through the rows, and clicking a bar narrows the list to that slice of time.

![The activity strip](https://zatosource-production.b-cdn.net/docs/gfx/audit-log/strip.webp?v=1789221716)

Dashboard menu: Monitoring > Audit log

### Message bodies {#message-bodies}

Opening an event's payload gives you two tabs, `Raw` and `Parsed`. The `Parsed` tab presents a structured message in readable form - an HL7 message as a tree, a scheduler run as its job, outcome, duration and captured log lines.

> **Note:** Opening a message body is itself recorded, under the `Log access` source, as who opened which message and from which screen.

### Attachments {#attachments}

Where a message arrived with files - an email's attachments, a transferred file - they appear as a strip of badges below the detail, each with its filename and size. Clicking one downloads it under its original name and content type.

Very large files keep their metadata but not their bytes, and say `not kept` rather than offering a download. Attachments are deleted along with the events that contain them.

## Message flow {#message-flow}

Reached from an event's detail pane through `Open flow`.

The listing shows what happened to one object. The flow shows what happened to one message, across every object it touched. A message that arrived on a channel, was sent to several destinations, had one of them fail and get resubmitted is one flow with all of those events in it, drawn as a diagram you can pan, zoom and replay in order. Related events are brought in whether they share the correlation ID, the message ID, or a resubmission link, and each line says which.

![One message's whole flow](https://zatosource-production.b-cdn.net/docs/gfx/audit-log/flow.webp?v=1790347258)

Dashboard menu: Monitoring > Audit log

Clicking a node opens its detail card - the events of that exchange, each with its role, outcome and timing, and the payload one more click away.

![A node's detail card](https://zatosource-production.b-cdn.net/docs/gfx/audit-log/flow-node.webp?v=1790347262)

Dashboard menu: Monitoring > Audit log

### Finding a flow from an identifier {#finding-a-flow-from-an-identifier}

The search box at the top of the flow page takes a control ID, a correlation ID or an event ID, and works out for itself which one you gave it. Paste in a reference somebody quotes at you and you get the whole exchange, without knowing which connection to look under first.

## Learn more {#learn-more}

- [Production checklist](https://zato.io/docs/admin/production-checklist.html) - What to confirm before an environment takes real traffic
- [Audit log](https://zato.io/docs/admin/audit-log/) - Every request, response and error, and what you can do with them afterwards
- [Health checks](https://zato.io/docs/admin/health-checks.html) - Have Zato ping your outgoing connections instead of waiting for traffic to fail
- [Logging](https://zato.io/docs/admin/logging.html) - What is written where, and how to ship it to Splunk, Loki, Elastic or Datadog
- [GitOps with enmasse](https://zato.io/docs/admin/enmasse.html) - Keep the whole environment in git as YAML and import it anywhere