All Parsec user connections and all administrative actions are recorded as auditable log events.
Downloading audit logs through the Parsec admin dashboard
A subset of the audit logs can be downloaded in JSON format from the Parsec admin dashboard, limited to 7 days history and a maximum of 5000 events.
Downloading audit logs through the API
Parsec for Teams Enterprise customers can download audit logs through the API. For further details see the API documentation.
Log Format
Logs are recorded as events in the following format:
|
The email of the user that took the action that recorded the event. This is the accounts current email, not the email when the event was recorded. |
|
| Event Name |
The name of the action taken. |
| Timestamp |
When the event was recorded. |
| Team ID |
This will always be the ID of your team. |
| Data |
JSON properties specific for each event. |
Connection events
Several events are recorded when a client connects to a host. Wherever applicable connection events are recorded both from the client's perspective and from the host's perspective. Most events contain an exit_code in the data column indicating the status of the connection. See the support article about exit codes for details.
| conn_client_offer |
The client has made a request to connect to a host. |
| conn_signal_offer_relayed |
The backend has approved and relayed the client's offer to connect to the host. |
| p2p_client_complete |
A connection attempt has been completed (successful or unsuccessful). See exit_code in the data column for status. |
| p2p_host_complete |
A connection attempt has been completed (successful or unsuccessful). See exit_code in the data column for status. |
| client_disconnect |
The connection is over for the client. See exit_code in the data column for status. |
| client_disconnect |
The connection is over for the host. See exit_code in the data column for status. |
Common data properties for connection events:
| Attempt ID |
The Attempt ID is a unique ID persistent for the duration of each Parsec peer-to-peer connection. |
| Host User ID |
The User ID of the host in connection events. For shared Team Computer's this will be 0. |
| Host Peer ID |
Host Peer IDs are persistent as long as a user is logged in on a device but may change if the user logs out and then logs in again on the same device. |
| Client User ID |
The User ID of the client in connection events. |
| Client Peer ID |
Client Peer IDs should not be relied upon to stay persistent between peer-to-peer connections. |
All events
| Event Name | Properties | Description |
| access_link_create | • ip • os • user • mouse • gamepad • team_id • keyboard • platform • starts_at • time_zone • event_name • expires_at • os_version • app_version • host_peer_id • host_user_id • access_link_id • client_peer_id • last_accessed_at |
An administrator created a guest access link |
| access_link_credit_export_ledger | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
An administrator exported the guest access transaction record |
| access_link_credit_purchase | • ip • os • amount • platform • os_version • app_version • host_peer_id • client_peer_id |
An administrator purchased guest access credits |
| access_link_disable | • ip • os • used • platform • os_version • app_version • host_peer_id • access_link_id • client_peer_id |
A guest access link was disabled |
| access_link_update | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • access_link_id • client_peer_id |
A guest access link was updated |
| client_disconnect | • ip • os • duration • platform • exit_code • attempt_id • os_version • app_version • host_peer_id • host_user_id • client_peer_id • client_user_id • connecting_to_self • host_computer_name • client_computer_name • host_is_team_computer |
A client disconnected from a host, recorded from the client side. The exit_code property indicates the reason the connection was terminated. |
| conn_client_offer | • ip • attempt_id • host_peer_id • host_user_id • client_peer_id • client_user_id • connecting_to_self • host_computer_name • host_is_team_computer |
A client has made an offer to connect to a host, and the offer has reached the backend. |
| conn_host_answer | • ip • warp • approved • attempt_id • host_peer_id • host_user_id • client_peer_id • client_user_id • connecting_to_self |
A host has answered a clients offer to connect, and the answer has reached the backend. |
| conn_signal_offer_relayed | • ip • attempt_id • permissions • host_peer_id • host_team_id • host_user_id • skip_approval • access_link_id • client_peer_id • client_user_id • connecting_to_self • host_computer_name • host_is_team_computer |
A clients offer to connect has been relayed to the host by the backend. |
| conn_signal_offer_unauthorized | • ip • desc • attempt_id • close_code • host_peer_id • host_user_id • access_link_id • client_peer_id • client_user_id • connecting_to_self • host_computer_name • host_is_team_computer • host_is_shared_team_computer |
|
| host_disconnect | • ip • os • duration • platform • exit_code • attempt_id • os_version • app_version • host_peer_id • host_user_id • client_peer_id • client_user_id • connecting_to_self • host_computer_name • client_computer_name • host_is_team_computer |
A client disconnected from a host, recorded from the host side. The exit_code property indicates the reason the connection was terminated. |
| p2p_client_complete | • ip • os • duration • platform • exit_code • attempt_id • os_version • app_version • host_peer_id • host_user_id • client_peer_id • client_user_id • connecting_to_self • host_computer_name • client_computer_name • host_is_team_computer |
A client to host connection attempt has been completed, recorded by the client. The exit_code property indicates if the connection attempt was successful or not. |
| p2p_host_complete | • ip • os • duration • platform • exit_code • attempt_id • os_version • app_version • host_peer_id • host_user_id • client_peer_id • client_user_id • connecting_to_self • host_computer_name • client_computer_name • host_is_team_computer |
A client to host connection attempt has been completed, recorded by the host. The exit_code property indicates if the connection attempt was successful or not. |
| team_api_key_create | • ip • os • platform • api_key_id • os_version • app_version • host_peer_id • client_peer_id |
An administrator created an API key |
| team_api_key_delete | • ip • os • platform • api_key_id • os_version • app_version • host_peer_id • client_peer_id |
An administrator deleted an API key |
| team_api_key_update | • ip • os • current • platform • previous • api_key_id • os_version • app_version • host_peer_id • client_peer_id |
An administrator updated an API key |
| team_app_config_update_global | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
An administrator updated the global App Settings |
| team_app_config_update_group | • ip • os • current • group_id • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
An administrator updated a groups App Settings |
| team_billing_card_update | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
An administrator updated the credit card on file |
| team_billing_update | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
An administrator updated the team's billing information |
| team_create | • ip • os • platform • team_name • os_version • app_version • total_seats • host_peer_id • client_peer_id |
The team was created |
| team_events_download | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
An administrator downloaded the audit logs |
| team_group_create | • ip • os • group_id • platform • group_name • os_version • app_version • host_peer_id • client_peer_id |
An administrator created a group |
| team_group_create_permitted_group | • ip • os • group_id • platform • direction • os_version • app_version • host_peer_id • client_peer_id • permitted_group_id |
An administrator added a groups permissions to connect to within the group or other groups |
| team_group_delete | • ip • os • group_id • platform • os_version • app_version • host_peer_id • client_peer_id |
An administrator deleted a group |
| team_group_delete_permitted_group | • ip • os • group_id • platform • os_version • app_version • host_peer_id • client_peer_id • deleted_group_id |
An administrator removed a groups permissions to connect to within the group or other groups |
| team_group_member_add | • ip • os • group_id • platform • member_id • os_version • app_version • host_peer_id • client_peer_id |
A user was added to a group |
| team_group_member_remove | • ip • os • team_id • group_id • platform • member_id • os_version • app_version • host_peer_id • client_peer_id |
A user was removed from a group |
| team_group_update | • ip • os • current • group_id • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
An administrator updated a group |
| team_invite_cancel | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
An administrator canceled an outstanding invite to the team |
| team_invite_resend | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
An administrator re-sent a team invite email |
| team_invite_send | • ip • os • platform • os_version • app_version • host_peer_id • team_group_id • client_peer_id |
An administrator created a new team invite |
| team_invite_update | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
An administrator updated an existing team invite |
| team_join | • ip • os • platform • os_version • app_version • host_peer_id • team_group_id • client_peer_id |
A user joined the team |
| team_machine_create | • ip • os • platform • os_version • app_version • assigned_user_id • team_machine_peer_id • assigned_team_group_ids |
A team computer was provisioned |
| team_machine_delete | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id • team_machine_id • assigned_user_id • assigned_group_id • team_machine_peer_id |
A team computer was deleted |
| team_machine_guest_delete | • ip • os • guest_id • platform • os_version • app_version • host_peer_id • client_peer_id • team_machine_id • team_machine_peer_id |
A user was kicked from a team computer |
| team_machine_key_create | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
A new Team Computer Key was generated |
| team_machine_update | • ip • os • current • platform • previous • os_version • app_version • team_api_key • team_machine_id • team_machine_peer_id |
A team computer was updated |
| team_member_remove | • ip • os • user_id • platform • os_version • app_version • host_peer_id • client_peer_id |
A team member was removed from the team |
| team_member_update | • ip • os • current • user_id • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
A team member was updated |
| team_notify_saml_enforce | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
The team was notified by email that SAML is now enforced |
| team_notify_tfa_enforce | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
The team was notified by email that two factor authentication is now enforced |
| team_role_assign | • ip • os • current • platform • previous • member_id • os_version • app_version • host_peer_id • client_peer_id |
An admin role was assigned to a team member |
| team_role_create | • ip • os • role_id • platform • os_version • app_version • host_peer_id • client_peer_id |
An admin role was created |
| team_role_delete | • ip • os • role_id • platform • os_version • app_version • host_peer_id • client_peer_id |
An admin role was deleted |
| team_role_unassign | • ip • os • current • platform • previous • member_id • os_version • app_version • host_peer_id • client_peer_id |
An admin role was removed from a team member |
| team_role_update | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
An admin role was updated |
| team_subscription_cancel | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
The team's subscription was cancelled |
| team_subscription_resume | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
The team's subscription was resumed |
| team_subscription_update | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
The team's subscription was updated |
| team_update | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
The team's properties were updated |
| tfa_confirm | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
A user completed setting up two factor authentication |
| tfa_delete | • ip • os • method • platform • os_version • app_version • host_peer_id • client_peer_id |
A user removed two factor authentication from their account |
| tfa_reset_backup_codes | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
A user reset their two factor authentication backup codes |
| tfa_send_reset | • ip • os • user_id • platform • requester • os_version • app_version • host_peer_id • client_peer_id |
An administrator sent an email to a team member allowing them to reset their two factor authentication |
| tfa_set_recovery_email | • ip • os • platform • os_version • app_version • host_peer_id • client_peer_id |
A user added an email to their account that can be used to reset their two factor authentication |
| user_change_password | • ip • os • tfa • method • platform • os_version • app_version |
A user changed their password |
| user_create | • ip • os • saml • platform • os_version • app_version |
A new user was created though SAML login |
| user_log_in | • ip • os • tfa • saml • platform • os_version • app_version |
A user logged in |
| user_send_password_reset | • ip • os • platform • os_version • app_version |
A user requested an email to reset thier password |
| user_update | • ip • os • current • platform • previous • os_version • app_version • host_peer_id • client_peer_id |
A user was updated |
| user_upgrade_session | • ip • os • tfa • saml • platform • os_version • app_version • host_peer_id • client_peer_id |
A user authenticated to enabled client mode on a team computer |