I. Intro
Who can perform these steps: Primary administrators or administrators with "Audit Log" permission.
As an administrator, you can query and trace the actions of administrators by checking the admin logs in the Lark Admin Console, as well as exporting the logs to local drives.
II. Steps
Query logs
- Open the Lark Admin Console and click Compliance > Audit Log > Admin log.
- 250px|700px|reset
- Select the event type, administrator, and time range (including start and end time).
- Note:
- The time range is required. The more conditions are selected, the more precise the query results will be.
- The default time range is the last 7 days. You can search from the preceding 180 days, but individual searches cannot cover more than 30 days.
- Click Search and enter the verification code to verify your administrator identity. You will see all administrator actions corresponding to the filter requirements.
250px|700px|reset
View log details
In the log list, click Details to the right of an entry to see an overview of the given event. For example, if the event type is "Change member info", the event details might be "Member A's 'Business Email' was changed from x to y".
250px|700px|reset
Export logs
When there are many query results, you may want to export the events found to the local drive for more flexible filtering and details.
- Above the log list, click Export.
- In the pop-up, fill in the file name as needed, and click Export data.
- Wait until the red bubble appears at the top of the page and click it to open the Admin task center to download the file.
250px|700px|reset