Activity log & audit

Every meaningful action in your organization is recorded, so you always have an answer to “who did what, when, and from where.”

What’s logged

• Organization — creation, renaming, and turning on fleet decisions
• Team — invitations sent, accepted and revoked; role changes; member removals
• Actions — dismiss, snooze, acknowledge
• Notifications — channels added, updated, deleted and tested; the fleet-wide silence delay changed
• Agents — enrollment tokens minted, agents renamed and deleted
• Servers — renamed, grouped, silence delay or mute changed, a note added, the public page enabled or revoked
• Active Defense — an address unbanned on every server, with the reason given and whether it was marked a false positive
• Sign-outs

Each entry captures the member, the details, the request IP address and user agent, and a precise timestamp. Open Activity in the sidebar (owner or admin) to browse and filter it.

Sign-ins are recorded too, with the method used — otp for an email code, passkey, or the social provider’s name — along with the IP and user agent, as are passkeys added to an account. They belong to your account rather than to one organization, so they do not appear on an organization’s Activity page.

Each server’s Activity tab shows the entries about that server, plus what the machine did on its own: reboots, package changes (including apt runs from before Demerzel was installed) and uptime milestones.

Deleting an organization

An organization’s activity log lives inside that organization, so deleting it removes the log too. Because a deletion needs to be auditable forever, Demerzel also writes a separate, permanent record of every organization deletion — capturing who requested it, the owner at the time, the member count, the IP, the user agent and the date. That record survives the deletion.