# The platform audit log

Find who did what anywhere on the installation, and export it.

In **Platform**, under **Installation**, open **Audit log**. Each organization’s admins see their own part in [their audit log](https://docs.gorunner.io/build/audit-log); this one holds every organization’s, and the installation’s own.

![The audit log: the four tabs, the filters, and rows such as License loaded and Two-factor turned on.](https://docs.gorunner.io/img/self-host/audit-log-light.jpg)

## Its views

- **People and admins**: Sign-ins, changes and admin acts, newest first.
- **Admin visits**: Each visit: who, where, why, how long, and how many changes. A row opens its timeline.
- **Your app’s API**: Your server’s calls to the partner API, with an Embed license.
- **Automatic**: What GoRunner did by itself, as hourly totals.

## Find an event

1. Type a person, an act or a place in the search, or press `/`.
2. Narrow it with **Who**, **Organization** and the period, from **24 hours** to **All time**, or **Custom**.
3. Select a row. Its detail shows the values before and after, its visit, the route and the address it came from.

## Export it

**Export CSV** downloads the events as filtered, every page of them, up to 100,000. Past that, the file’s last row says to narrow the period for the rest; otherwise it says the file is complete. A download cut short is never saved. It needs a license that includes **Audit export**.

## How long it is kept

The foot says **Kept forever**, or how many days. Rows older than `AUDIT_RETENTION_DAYS` are deleted every hour; set it in `.env` and restart. **Change** opens the start-up settings on [Monitoring](https://docs.gorunner.io/self-host/monitoring-page#start-up-settings).

That setting deletes every kind of row, security events included. To keep the log and only shrink it, set `AUDIT_CREDENTIAL_USE_RETENTION_DAYS` instead: it deletes just the credential use GoRunner itself recorded, and each connection keeps its latest use. Empty keeps everything. See [Settings (.env)](https://docs.gorunner.io/self-host/settings#AUDIT_CREDENTIAL_USE_RETENTION_DAYS).

**Why does it name people, when monitoring doesn’t?**

“Who did it” is the audit log’s whole point. It stays in GoRunner, for admins. An organization can stream its own part to its tools with [event streaming](https://docs.gorunner.io/build/event-streaming).

## Related

- [Visit an organization](https://docs.gorunner.io/self-host/visit-an-organization): What a visit records · 3 min
- [The audit log](https://docs.gorunner.io/build/audit-log): An organization’s own · 3 min

Source: https://docs.gorunner.io/self-host/platform-audit-log