Team Audit Logs

All Parsec user connections and all administrative actions are recorded as auditable log events.

Downloading audit logs through the Parsec admin dashboard

A subset of the audit logs can be downloaded in JSON format from the Parsec admin dashboard, limited to 7 days history and a maximum of 5000 events. 

Downloading audit logs through the API

Parsec for Teams Enterprise customers can download audit logs through the API, without limitations on history. For further details see the API documentation.

Log Format

Logs are recorded as events in the following format:

Email

The email of the user that took the action that recorded the event. This is the accounts current email, not the email when the event was recorded.

Event Name

The name of the action taken.

Timestamp

When the event was recorded.

Team ID

This will always be the ID of your team.

Data

JSON properties specific for each event.

Connection events

Several events are recorded when a client connects to a host. Wherever applicable connection events are recorded both from the client's perspective and from the host's perspective. Most events contain an exit_code in the data column indicating the status of the connection. See the support article about exit codes for details.

conn_client_offer

The client has made a request to connect to a host.

conn_signal_offer_relayed

The backend has approved and relayed the client's offer to connect to the host.

p2p_client_complete

A connection attempt has been completed (successful or unsuccessful). See exit_code in the data column for status.

p2p_host_complete

A connection attempt has been completed (successful or unsuccessful). See exit_code in the data column for status.

client_disconnect

The connection is over for the client. See exit_code in the data column for status.

client_disconnect

The connection is over for the host. See exit_code in the data column for status.

Common data properties for connection events:

Attempt ID

The Attempt ID is a unique ID persistent for the duration of each Parsec peer-to-peer connection.

Host User ID

The User ID of the host in connection events. For shared Team Computer's this will be 0.

Host Peer ID

Host Peer IDs are persistent as long as a user is logged in on a device but may change if the user logs out and then logs in again on the same device.

Client User ID

The User ID of the client in connection events.

Client Peer ID

Client Peer IDs should not be relied upon to stay persistent between peer-to-peer connections.

All events

Event Name Properties Description
access_link_create • ip
• os
• user
• email
• mouse
• gamepad
• team_id
• keyboard
• platform
• starts_at
• time_zone
• event_name
• expires_at
• os_version
• app_version
• host_peer_id
• host_user_id
• access_link_id
• client_peer_id
• last_accessed_at
An administrator created a guest access link
access_link_credit_export_ledger • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator exported the guest access transaction record
access_link_credit_purchase • ip
• os
• amount
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator purchased guest access credits
access_link_disable • ip
• os
• used
• platform
• os_version
• app_version
• host_peer_id
• access_link_id
• client_peer_id
A guest access link was disabled
access_link_update • ip
• os
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• access_link_id
• client_peer_id
A guest access link was updated
client_disconnect • ip
• os
• duration
• platform
• exit_code
• attempt_id
• os_version
• app_version
• host_peer_id
• host_user_id
• client_peer_id
• client_user_id
• connecting_to_self
• host_computer_name
• client_computer_name
• host_is_team_computer
A client disconnected from a host, recorded from the client side. The exit_code property indicates the reason the connection was terminated.
conn_client_offer • ip
• attempt_id
• host_peer_id
• host_user_id
• client_peer_id
• client_user_id
• connecting_to_self
• host_computer_name
• host_is_team_computer
A client has made an offer to connect to a host, and the offer has reached the backend.
conn_host_answer • ip
• warp
• approved
• attempt_id
• host_peer_id
• host_user_id
• client_peer_id
• client_user_id
• connecting_to_self
A host has answered a clients offer to connect, and the answer has reached the backend.
conn_signal_offer_relayed • ip
• attempt_id
• permissions
• host_peer_id
• host_team_id
• host_user_id
• skip_approval
• access_link_id
• client_peer_id
• client_user_id
• connecting_to_self
• host_computer_name
• host_is_team_computer
A clients offer to connect has been relayed to the host by the backend.
conn_signal_offer_unauthorized • ip
• desc
• attempt_id
• close_code
• host_peer_id
• host_user_id
• access_link_id
• client_peer_id
• client_user_id
• connecting_to_self
• host_computer_name
• host_is_team_computer
• host_is_shared_team_computer
 
host_disconnect • ip
• os
• duration
• platform
• exit_code
• attempt_id
• os_version
• app_version
• host_peer_id
• host_user_id
• client_peer_id
• client_user_id
• connecting_to_self
• host_computer_name
• client_computer_name
• host_is_team_computer
A client disconnected from a host, recorded from the host side. The exit_code property indicates the reason the connection was terminated.
p2p_client_complete • ip
• os
• duration
• platform
• exit_code
• attempt_id
• os_version
• app_version
• host_peer_id
• host_user_id
• client_peer_id
• client_user_id
• connecting_to_self
• host_computer_name
• client_computer_name
• host_is_team_computer
A client to host connection attempt has been completed, recorded by the client. The exit_code property indicates if the connection attempt was successful or not.
p2p_host_complete • ip
• os
• duration
• platform
• exit_code
• attempt_id
• os_version
• app_version
• host_peer_id
• host_user_id
• client_peer_id
• client_user_id
• connecting_to_self
• host_computer_name
• client_computer_name
• host_is_team_computer
A client to host connection attempt has been completed, recorded by the host. The exit_code property indicates if the connection attempt was successful or not.
team_api_key_create • ip
• os
• platform
• api_key_id
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator created an API key
team_api_key_delete • ip
• os
• platform
• api_key_id
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator deleted an API key
team_api_key_update • ip
• os
• current
• platform
• previous
• api_key_id
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator updated an API key
team_app_config_update_global • ip
• os
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator updated the global App Settings
team_app_config_update_group • ip
• os
• current
• group_id
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator updated a groups App Settings
team_billing_card_update • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator updated the credit card on file
team_billing_update • ip
• os
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator updated the team's billing information
team_create • ip
• os
• platform
• team_name
• os_version
• app_version
• total_seats
• host_peer_id
• client_peer_id
The team was created
team_events_download • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator downloaded the audit logs
team_group_create • ip
• os
• group_id
• platform
• group_name
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator created a group
team_group_create_permitted_group • ip
• os
• group_id
• platform
• direction
• os_version
• app_version
• host_peer_id
• client_peer_id
• permitted_group_id
An administrator added a groups permissions to connect to within the group or other groups
team_group_delete • ip
• os
• group_id
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator deleted a group
team_group_delete_permitted_group • ip
• os
• group_id
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
• deleted_group_id
An administrator removed a groups permissions to connect to within the group or other groups
team_group_member_add • ip
• os
• group_id
• platform
• member_id
• os_version
• app_version
• host_peer_id
• client_peer_id
A user was added to a group
team_group_member_remove • ip
• os
• team_id
• group_id
• platform
• member_id
• os_version
• app_version
• host_peer_id
• client_peer_id
A user was removed from a group
team_group_update • ip
• os
• current
• group_id
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator updated a group
team_invite_cancel • ip
• os
• email
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator canceled an outstanding invite to the team
team_invite_resend • ip
• os
• email
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator re-sent a team invite email
team_invite_send • ip
• os
• email
• platform
• os_version
• app_version
• host_peer_id
• team_group_id
• client_peer_id
An administrator created a new team invite
team_invite_update • ip
• os
• email
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator updated an existing team invite
team_join • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• team_group_id
• client_peer_id
A user joined the team
team_machine_create • ip
• os
• platform
• os_version
• app_version
• assigned_user_id
• team_machine_peer_id
• assigned_team_group_ids
A team computer was provisioned
team_machine_delete • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
• team_machine_id
• assigned_user_id
• assigned_group_id
• team_machine_peer_id
A team computer was deleted
team_machine_guest_delete • ip
• os
• guest_id
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
• team_machine_id
• team_machine_peer_id
A user was kicked from a team computer
team_machine_key_create • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
A new Team Computer Key was generated
team_machine_update • ip
• os
• current
• platform
• previous
• os_version
• app_version
• team_api_key
• team_machine_id
• team_machine_peer_id
A team computer was updated
team_member_remove • ip
• os
• user_id
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
A team member was removed from the team
team_member_update • ip
• os
• current
• user_id
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
A team member was updated
team_notify_saml_enforce • ip
• os
• email
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
The team was notified by email that SAML is now enforced
team_notify_tfa_enforce • ip
• os
• email
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
The team was notified by email that two factor authentication is now enforced
team_role_assign • ip
• os
• current
• platform
• previous
• member_id
• os_version
• app_version
• host_peer_id
• client_peer_id
An admin role was assigned to a team member
team_role_create • ip
• os
• role_id
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An admin role was created
team_role_delete • ip
• os
• role_id
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
An admin role was deleted
team_role_unassign • ip
• os
• current
• platform
• previous
• member_id
• os_version
• app_version
• host_peer_id
• client_peer_id
An admin role was removed from a team member
team_role_update • ip
• os
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
An admin role was updated
team_subscription_cancel • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
The team's subscription was cancelled
team_subscription_resume • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
The team's subscription was resumed
team_subscription_update • ip
• os
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
The team's subscription was updated
team_update • ip
• os
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
The team's properties were updated
tfa_confirm • ip
• os
• email
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
A user completed setting up two factor authentication
tfa_delete • ip
• os
• method
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
A user removed two factor authentication from their account
tfa_reset_backup_codes • ip
• os
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
A user reset their two factor authentication backup codes
tfa_send_reset • ip
• os
• email
• user_id
• platform
• requester
• os_version
• app_version
• host_peer_id
• client_peer_id
An administrator sent an email to a team member allowing them to reset their two factor authentication
tfa_set_recovery_email • ip
• os
• email
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
A user added an email to their account that can be used to reset their two factor authentication
user_change_password • ip
• os
• tfa
• method
• platform
• os_version
• app_version
A user changed their password
user_create • ip
• os
• saml
• email
• platform
• os_version
• app_version
A new user was created though SAML login
user_log_in • ip
• os
• tfa
• saml
• platform
• os_version
• app_version
A user logged in
user_send_password_reset • ip
• os
• email
• platform
• os_version
• app_version
A user requested an email to reset thier password
user_update • ip
• os
• current
• platform
• previous
• os_version
• app_version
• host_peer_id
• client_peer_id
A user was updated
user_upgrade_session • ip
• os
• tfa
• saml
• platform
• os_version
• app_version
• host_peer_id
• client_peer_id
A user authenticated to enabled client mode on a team computer