Activity: what happened on this server

What this page is for. One list of everything that has happened on this server, so "who changed that?" and "did the backup run?" have the same answer in the same place. It is the Activity page in the Panel menu group.

You need

• To be logged in to the panel (First login).

What it shows

Two records, merged into one stream, newest first:

• What a person did. Every action taken through the panel, with the address it came from: logins, deploys, restores, password changes, secret reveals, settings changes.
• What the panel did. Every job it ran — installs, backups, certificates, database work, its own repairs — with how it went and a log you can open.

So a row is either an action or a job. A job's row carries a View log button, and its status reads finished, failed, running or waiting. A failed one says which step it failed at.

The three questions the filters answer

They are the three ways an owner asks "what happened":

• Who — a signed-in person, or the panel by itself. The badge on each row is more specific than the filter: admin (a person, and hovering it shows the address), scheduled, push deploy, self-heal, maintenance, CLI, or panel. Hold on to that distinction: a service that came back at 3 a.m. reads self-heal, not you.
• Project — one shop, or Server-wide (no project) for the things that are about the machine rather than any one of them.
• Kind — Backups, Domain & SSL, Database, Deploys, Cloudflare, Security, Projects, App .env, Scheduled tasks, Services, Maintenance, System.

Then the search box, over the wording of each row. Filtering is instant: it never goes back to the server, so the box keeps your place and your focus.

A dash instead of a badge is honest, not broken. Jobs only started recording who asked for them in a later version, so a job old enough to predate that says — rather than guessing at you.

Reading down, and reading back

The page draws the newest 40 rows that match your filters and says so, with Show all N on this page if you want the rest. That is a display cap only — the filters and the search run over everything fetched, so nothing is hidden from a search.

Once everything fetched is on screen, Show older activity appears and goes back to the server for several hundred more. The two buttons are never offered at once, because they sound the same and do different things.

What this page is not

It is not a permanent archive, and nothing here is a backup.

• The action record is capped — old entries are dropped from the oldest end once it grows past its limit — so treat it as recent history, not a ledger you can audit a year later.
• The job history is shorter still: the panel keeps the last twenty, and a job that has not finished is never dropped no matter how far back it started.

If you need to keep a record of something — a job log that explains an outage, a deploy that went wrong — copy it out while it is here.

The same log on the Security page

Security has an Activity log of its own, and it is the same actions record, filtered by action name with a row limit. The difference is what each one is for: the Security page answers "who has been in this panel and what did they touch", beside the passwords, sessions and lockouts it belongs with. This page answers "what has been happening on this server", and it is the only one of the two that also shows the panel's own jobs. Reach for whichever question you have — see Security.

What is recorded that you might not expect

• Revealing a secret. Opening a hidden value — a database password, a backup password, a stored token — is written down, so a look is never silent. Nothing records the value itself.
• The panel repairing itself. Automatic repairs are on by default, and every one of them lands here as self-heal, whether it worked or not. See The panel, page by page.
• Push deploys. A deploy triggered by a git push is recorded as push deploy, with the repository it came from.
• Refused things. An action the panel turned down is recorded along with the reason, which is often the fastest explanation of why something did not happen.

How to check it worked

• Open Activity. The newest row is something you recognise — your own login, or the last job you started.
• Set Who to Automatic (the panel itself). What is left is the panel working unattended: renewals, backups, its own repairs.
• Press View log on any job row. Its full log opens.

If it went wrong

• The page says the demo hides this one thing — you are signed in as the read-only demo login, which is refused this feed on purpose: it carries the owner's own addresses. Sign in as the owner. See Let someone else in.
• A row you expected is not there — check the filters first (Who, Project and Kind all narrow it), then whether it is older than what is kept. A job from weeks ago is gone; the action record reaches further back.
• A row says — under Who — that job predates the panel recording who asked for it. Nothing is wrong.
• Nothing at all is listed — an empty list on a server that has been used means something is wrong with reading the record, not that nothing happened. Check Server → Health and then When something is broken.