The DataHub Audit feature provides a comprehensive record of system activity. It captures security events, configuration changes, connection activity, scripting operations, and other significant actions through four mechanisms:
Audit events — predefined events raised by DataHub components when significant actions occur. Events are organized into categories and associated with sources.
Audit data points — selected DataHub data points whose value changes are recorded as audit events.
Local storage — a local SQLite database that persists audit records for querying and CSV export.
Local Git tracking — a local Git repository that maintains a detailed version history of configuration file changes.
For a complete reference of all audit configuration options, see Audit in the Properties Window chapter.
The audit trail supports several operational needs:
Compliance — maintain tamper-resistant records of system activity to satisfy regulatory requirements.
Security forensics — investigate authentication failures, unauthorized access attempts, and session activity.
Change accountability — track who changed what, when, and from where.
Operational visibility — monitor connection lifecycles, plugin activations, and system health in real time through DataHub data points.
Here are the types of questions the Audit capability helps you answer:
Security and Authentication
Who authenticated to the system in the last 24 hours, and from what IP addresses?
When did user `joe2` last authenticate, and from what IP address?
Were there any failed authentication attempts this week?
Which user accounts were created, modified, or deleted recently?
What roles or permission sets were changed, and when?
Who bypassed an authentication factor?
Configuration Changes
Who changed the MQTT Broker configuration?
What changes were made to the OPC UA configuration?
When was the security configuration last modified?
What configuration files were added, changed, or renamed (via Git tracking)?
Connectivity
When did the OPC UA Client connection last disconnect?
Which incoming connections were established or dropped today?
What outgoing connections failed this week?
Data Point Monitoring
Who changed the setpoint for the boiler on line 2, and when?
What values were written to a specific data point over the past week?
Application Lifecycle
When was the application last started or stopped?
Which plugins failed to activate, and when?
Were any plugin license states changed?
Web Content
What web content files were modified or deleted recently?
When was the web content last recached?
Audit Subsystem
When was local audit storage last started or stopped?
Were any old audit records purged, and how many?
Git Configuration History
What is the current status of the local Git repository for the configuration directory?
What files were included in the most recent configuration commit?