**Team -> Activity log**

Everything that happens on your platform, the latest first: what your team
changed in the admin panel, what traders did with their accounts, every sign-in
and every failed one, and what the platform did by itself, such as a payout it
settled or an account it failed. Each entry says what happened, who did it, what
it was about and where it came from. It cannot be switched off.

The backup by email and how much of the log is kept are the screen's settings,
behind the **Settings** button above the list.

## The list

The list opens on every entry across the whole width of the screen. Nothing is
opened until you pick one. Then the list folds to a column on the left and the
entry slides in beside it. `Esc` or the cross folds it back out.

Under the title stand how many entries there are and since when, then three
counts: what the team did in the last 24 hours, failed sign-ins in the last 7
days, and page views. Click a count to show only those, and click it again to
show everything.

Each row shows who did it, with their picture, what happened, the kind of entry,
what it was about, the IP address it came from and when. What it was about
carries the name the entry was written with, since a record can be renamed or
deleted later, and a person's name as it is now when the entry kept none, as a
sign-in does. Entries done by the platform itself show a small chip mark, and
attempts by somebody who was not signed in, such as a failed sign-in, a key.
When a member of your team acted while looking at the platform as a trader, the
row says so.

`J` and `K` walk the list and `Enter` opens the lit row. Once an entry is open,
resting on another row with `J` or `K` opens that one beside it. A right click
on a row opens it, opens the record or the person, narrows the list to that
person, that record, that IP address or that event, or copies the description,
the number, the ID or a link.

Each entry has its own address, `/admin/activity-logs/alog_...`, so a link from a
colleague opens straight on it, with the tab it was on.

## Search, filters and sorting

Search matches the description, the name of the record, the person's name and
email address, the event and the IP address. Several words narrow further: every
one of them has to match. A full ID finds everything about that record or
person, whatever kind it is (`usr_...`, `acct_...`, `pay_...`), including entries
that only mention it. A short number such as `#Q8R3T6` finds the entry, the
person or the record with that number, an IP address finds everything from it,
and the start of one (`81.204.`) everything from that range. Press `/` anywhere to
jump to the search box.

The filter menu holds the sort order and the filters:

| Filter      | What it narrows to                                                             |
| ----------- | ------------------------------------------------------------------------------ |
| When        | The last 24 hours, 7, 30 or 90 days, or two days you choose                     |
| Done by     | The team, traders, or the platform itself and anybody not signed in            |
| Team member | One person on your team                                                        |
| Kind        | Changes, sign-ins, admin actions, trading, platform events                     |
| Event       | One event, from the events your log actually holds                             |
| Page views  | Left out, shown with everything else, or only page views                       |

Page views are left out until you ask for them, because a few hours of them
would bury everything else. Days are counted in your firm's timezone, and the
last day you choose counts in full. The list can also be narrowed to one trader
or one record, which other screens do when they link here: **Users**, **Team**,
**Trading accounts**, **Payments**, **Payouts**, **Roles**, **Challenges**,
**Challenge deals** and **Trading rules** each have a link to their record's
history. A line under the search says what the list is narrowed to, and each part
of it comes off with a click.

The orders are newest and oldest first, from the menu or the head of the When
column. Filters and the page live in the address bar, so a filtered view can be
bookmarked or sent to a colleague.

The download button beside the search exports exactly what the list shows,
every page of it, as a CSV. Every export is itself written to the log.

## An entry

The head shows who did it, what happened, the entry's short number (which copies
with a click), its kind and its event. Under it stands what is worth knowing:
that it was done while looking as a trader, or that the person or the record has
since been deleted. Beside it sits the way to what the entry was about: **Open**
the account, the role, the payout or whatever the record is, or **Open the page**
for a page view in the admin panel. The menu behind `...` opens the person,
narrows the list, and copies the description, the number, the ID, the IP address
or a link.

Below that are the facts asked first: when, who did it and whether they are on
your team or a trader, the record it was about, the IP address with its location
and network, and the browser and system it came from.

| Tab            | What it holds                                                                                                                                                                                                                         |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Details        | What changed: each field with what it was and what it became, down to the one key inside a setting that moved. For a new record what it was created with, and otherwise what was written down with the entry. Every account, person or other record in there is named and, where you may open it, a link. Under it, where the entry came from: the IP address, location, provider and kind of network, and the device. |
| Record history | Every entry about the same record, newest first, with this one marked. Any of them opens here in place of this one, and **Show in the list** narrows the list to that record.                                                          |
| Around it      | What the same person did in the hour before and after, oldest first, or, when nobody was signed in, what came from the same IP address. For a failed sign-in that shows the attempts around it, for a change what led up to it.         |

The location and network come from what the fraud checks already learnt about
the address. Opening an entry never looks an address up anywhere.

## Settings

**Settings** opens the screen's settings where an entry would open, with an
address of their own, `/admin/activity-logs/settings`.

**Backup by email** mails a CSV of the whole log on a schedule: weekly, monthly,
every 3, 6 or 12 months, or off. It goes out on the day it falls due, at 02:00
UTC, to up to five addresses you choose. Without any, it goes to your billing
address, or your support address when there is no billing address. The head says
whether a backup is scheduled, when the last one went, when the next one goes and
to whom. **Email a backup now** sends one straight away, after asking, and a
schedule then counts on from that day, so the next one moves with it. A
warning shows when there is nowhere to send it, and when the log is already
dropping old entries while no backup is set.

**What is kept** shows how much of the log the platform holds: the latest 1000
entries and 1500 page views of every firm, with older ones removed every night.
That is the same for every firm and not a setting, which is why the backup
exists.

Changing the schedule or the addresses is a change: it is saved with the save bar
at the bottom, and leaving with unsaved changes asks first. Only what you changed
is sent. Emailing a backup now acts at once, and is written to the log with the
addresses it went to.

## Who can do what

Reading the log, its entries and its settings, and the export, need **View
Activity Logs**. Changing the backup and emailing one now need **Manage
Settings**: without it the settings are shown read-only and the button is not
there. The links to a trader, a team member or a record follow the permissions
of those screens, so somebody who may not open Users sees a trader's name without
a link.

Entries made by Propper's own staff while supporting your firm are not in your
log.

## In the older designs

A firm on the OG or Tactical design keeps the screen it had: one page with the
search, the kind, event and person filters, two dates, page views, the export,
and a backup schedule that goes to your billing or support address. Entries open
in place to show what changed. An entry's own page, the record history, what
happened around an entry, choosing the addresses of the backup and emailing one
now are only in the new Default. A link to an entry there lands on the list.