Audit Log
The CH-UI audit log — who did what, when, across sign-ins, connections, roles, and license events.
The audit log records administrative and user actions in CH-UI, so admins can answer "who changed this, and when?" — a baseline requirement for security reviews and SOC 2. It's a Pro feature, available to admins under Governance → Audit Log (and the Admin panel).
This is the application audit log (administration and user activity). It is distinct from the Governance query audit, which records ClickHouse query activity and metadata changes inside a connection.
What's recorded
- Sign-ins — successful and failed logins, with password or SSO
- Connection changes — a connection (tunnel or direct) is added, edited, or removed
- Role changes — a user's CH-UI role is changed by an admin
- License events — a Pro license is applied, renewed, or removed
Each entry captures the actor (email or ClickHouse user), the action, an optional target (e.g. the affected user or connection), structured metadata, the IP address, the user agent, and a timestamp.
Using it
The page lists events newest-first with:
- Search across actor, action, and target
- Action filter (sign-ins, connection changes, role changes, license events)
- Time range (24h / 7 days / 30 days / all time)
- Load more paging
Properties
- Tamper-resistant by design: there is no UI to edit or delete individual entries.
- Actor preserved: the actor's identity is stored on the event, so the trail stays meaningful even if the user is later removed.
- Local by default: events live in CH-UI's local SQLite database on your own server — nothing leaves your infrastructure unless you forward it.
Forwarding to a SIEM
Audit events can be streamed out for retention and correlation:
| Setting | Behavior |
|---|---|
audit_webhook_url | POST each event as JSON to your collector |
audit_log_file | Append events as JSON lines to a file |
audit_forward_stdout | Emit events on stdout for log shippers |
See Monitoring & SIEM for details.