Find out what happened with the activity log

When a site breaks, the first question is "what changed?". SrvYard keeps a running record of what happened to your servers and sites: deployments, certificate renewals, domains, daemons, scheduled jobs, SSH keys, firewall rules, backups, heartbeats and more. Each entry says what happened, who did it and when.

This article shows where the feed lives, how to filter it, how the notification centre differs from it, where your own sign-in history is, and what the audit record is for. It also says plainly how long things are kept, because the activity feed is deliberately short-lived.

Before you begin#

• View access to the server or site. The feed shows the events of the servers and sites you can see. If a team limits you to some servers, you only see what happened to those. See Limit members to certain servers and sites.
• Nothing to turn on. SrvYard records events by itself. You cannot switch the feed off.
• A sense of the time window. The feed keeps the last 14 days. Older events are removed every day, so write down anything you need to keep for longer.

1. Open the activity of a server#

Open the server and choose Activity in the row of tabs.

1. Activity. The tab. The description under the title reads "What happened to this server and its sites in the last 14 days".
2. Type. A filter button, explained in step 2. Next to it a search box finds a word in the description, such as a domain name or a deployment.
3. An event row. Four columns. Event is the type, with an icon, for example Deployments, Heartbeats, Scheduled jobs, Daemons, Domains or Sites. What happened is a sentence. By is the member who did it, or SrvYard for what the system did itself (a heartbeat that was not received, a certificate that renewed). When is how long ago, and sorts the list; the newest comes first.

The View button at the right chooses which columns to show, and the list is paged: pick the number of rows per page at the bottom.

2. Filter by type#

Press Type to narrow the list to what you are investigating.

1. The type list. Tick one or more of Deployments, Servers, Sites, Certificates, Domains, Daemons, Scheduled jobs, SSH keys, Databases, Firewall, Monitors, Backups, Heartbeats and Notifications. The list scrolls, and the box at the top searches it. The table shows only the ticked types until you clear them.

Combine the filter with the search box. To see only what members did to the firewall, tick Firewall. To find why a site changed, search for its domain name.

3. Use the overview for a quick look#

The server Overview tab shows the latest events, so you can see at a glance what has been going on.

1. The latest events. The most recent entries with an icon and how long ago.
2. View all activity. Opens the full feed described above.

A site has its own feed under Observe > Activity, limited to that site. See Site activity and Observe.

4. Notifications are not the activity feed#

The feed records what happened. The notification centre records what was sent to you: only the events your settings let through, for the organisation you are in. Open it from the bell in the top bar and choose View all notifications.

1. Unread and All. Two tabs; the number in brackets counts what you have not read.
2. Mark all read. Clears the unread count in one go. Preferences, next to it, opens your notification settings.
3. A notification. A title, a sentence of detail, the organisation and how long ago. Opening one takes you to the server or site it is about.

Whether something shows up here is decided by your own settings and by whether the server is muted for you: see Alert thresholds and silencing. To push events to Slack or email, use Notification channels.

5. Sign-in history and the audit record#

Two other records exist, and they serve different purposes.

• Your sign-in log. Under your account settings, Security has an Auth Log: "Every sign-in attempt on this account, successful or not", with time, status, method, device, location and the reason for a failure. You are asked to confirm your password before it opens. Check it when you suspect somebody else has used your account, and read Two-factor authentication and active sessions.
• The audit record. SrvYard also writes a separate audit entry for sensitive changes, such as who added or changed a monitor, a channel or a webhook, and from which address. It is kept for SrvYard's own review of security-relevant actions and is not shown on a page of your account. For what your team did to servers and sites, use the activity feed above.

6. Read the feed from the API#

The same feed is available to scripts. GET /api/v1/activity returns the events of the organisation, newest first, and accepts the filters type (comma-separated), server, site and q. A token needs the activity:view scope. It holds the same 14 days. See Create an API token and pick scopes.

What the feed is good for#

Treat the feed as a short diary. A few habits make it more useful:

• Check it first when something breaks. Open the server or site, read the newest rows and look for a deployment, a certificate event or a domain change shortly before the trouble started.
• Check it after a change. If you, or a colleague, changed a firewall rule or an SSH key, the feed confirms that it was applied and by whom.
• Use the search for names. The search box looks at the description, so a domain, a daemon name or a site name finds every related event.
• Pair it with metrics. A spike on the server charts and a deployment in the feed at the same minute tell a story together.

Troubleshooting#

• An event I expected is missing. It may be older than 14 days, may belong to a server or site you cannot see, or may be filtered out. Clear the Type filter and the search box first.
• The feed shows "SrvYard" but I did the thing. Events that finish on their own, such as a deployment completing, are recorded as SrvYard even when a member started it. Your name appears on what you did directly, such as cancelling a deployment.
• I need to keep the history longer. The feed keeps 14 days. Copy what you need, or fetch it from the API on a schedule and store it yourself.
• A notification I expected never arrived. The notification centre only shows what your settings allow and for the organisation you are in. Check that the event is on in your settings and that the server is not muted for you.
• Someone changed a setting and I cannot tell who. The feed only covers the event types in the filter. Sensitive changes go to the audit record, which your account does not show. Ask the owners and admins of the organisation, and contact support if you need more: see Get help.

Related#

• Site activity and Observe: the per-site feed, health check and logs.
• Notification channels: send events to Slack, Discord, Telegram or email.
• Least privilege and auditing: who can see and do what in an organisation.
• Two-factor authentication and active sessions: protect the account behind the sign-in log.