Activity Log

See who did what in your Lavawall console, and prove to an auditor that the record has not been altered.

Open Activity Log in your console

Where to find it
Logs & monitoring › Lavawall® Log
Who can use it
Administrators. Other users see "Admin access required to view activity logs." Mark reviewed appears only for people allowed to sign off reviews.
For
Everyone
Plan
Included with every Lavawall® account. See plans
Feature
Risk-Based Notifications for IT and MSPs

What the page is for

Activity Log is a page in the Lavawall® console, in the Logs & monitoring area. Lavawall is the RMM, security, and compliance platform from ThreeShield, built and hosted in Canada. About this feature.

The Activity Log records actions taken in the Lavawall console and by its components: sign-ins, changes to users, devices, software packages, scripts, remote sessions, consent and more. Each entry shows when it happened, what the action was, who did it, what it affected, which company it belongs to and the IP address it came from.

The log is tamper-evident. It is sealed automatically once a day, and the Integrity bar shows whether the log still matches its last seal. You can re-run that check at any time, export the log for an auditor with what they need to verify it, and record that you reviewed a range of entries.

What you see

The Activity Log page, with the integrity bar, filters, results, log table, and log entry detail numbered 1 to 5.
The Activity Log page. Numbers match the list below.
  1. Integrity bar: the seal status, when it was last sealed and last reviewed, with Re-verify, CSV (export for auditors), JSON (export the evidence package) and Mark reviewed.
  2. Filters: Search, Action, Actor, Target, IP, From and To, with search and clear buttons.
  3. Results: a count and Previous / Next paging.
  4. Log table: Time, Action, Actor, Target, Company, IP, Details and Protected.
  5. Log Entry Detail: the full entry, including exact time, integrity status, actor and target companies and details. Details recorded as structured data are shown one item per line, with nested items indented; Show the details as recorded shows the original text.

How to use Activity Log

How to find an action

  1. Enter words in Search, or choose one or more actions in Action (type part of a name to search the list). Choose Potentially malicious at the top of the list to see remote control sessions, file transfers and script runs together.
  2. Start typing a name or email in Actor, or a user, computer or mailbox in Target, and choose a match from the list for an exact filter.
  3. Set From and To dates, then click the search button.
  4. Click a row to open Log Entry Detail.

How to follow a trail

  1. Click an IP address in the table to show all activity from that address.
  2. Click the filter icon next to a computer to show all activity for it, or the computer name to open its detail page.
  3. Click the clear button to reset the filters.

How to check the log has not been altered

  1. Look at the Integrity badge: Verified or Protected is expected.
  2. Click Re-verify to check the log against its seal again.

How to see the commands typed in a remote shell

  1. Find a remote shell entry, for example by choosing Remote control PowerShell connected in Action.
  2. Click Commands on that entry. The button appears only when commands were recorded for that session; otherwise the entry says that no commands were recorded, that the computer’s agent was too old to record them, or that command logging was not available for that session yet. The commands typed in that session open below it, with the time, the technician who typed each one and the shell it was typed in.
  3. Type in Filter commands to narrow the list, click a column heading to sort it, or click CSV to download the commands. Times in the CSV file are in UTC.
  4. Check Integrity: Verified means the record matches the tamper-protected activity log. A warning appears if a recorded command is missing from the list.
  5. Passwords, keys and tokens were removed before the command was stored, and Notes says when that happened. Encoded PowerShell commands show their decoded text, and a command rebuilt from history or tab completion is labelled Reconstructed, with the keys that were pressed. Shell output is not recorded.
  6. Each time you open or download the commands, that is recorded in the activity log.

If the entry says that command logging is not supported by this agent version, update the Lavawall® agent on that computer. Shell sessions still work on older agents, but what was typed in them isn't recorded.

How to give an auditor the log

  1. Set From and To (and optionally one or more actions in Action; the CSV uses the same actions).
  2. Click CSV and Download CSV for a spreadsheet with what the auditor needs to check it, or JSON and Download JSON for the full evidence package, including each seal and a fresh check.
  3. Each export is itself recorded in the log.

How to sign off a log review

  1. Filter and page to the entries you reviewed.
  2. Click Mark reviewed.
  3. Optionally type Findings, such as "no anomalies", and click Sign off. The Integrity bar then shows when the last review was done and by whom.

Tips

  • Action badges are colour-coded by type, for example sign-in activity, device actions, packages, user management, remote sessions, consent and scripts.
  • Times are shown in your local time to hundredths of a second; the detail view also shows the stored UTC time.
  • In the Protected column, a shield means the entry is covered by the seal. ok or fail shows the stated outcome. A dash means the entry was recorded before tamper protection started.
  • Sign off reviews on a regular schedule so your compliance evidence shows continuous monitoring.

Troubleshooting

"Admin access required to view activity logs."
Ask an administrator in your organization for access.
"Not sealed yet".
The log is sealed automatically once a day. Check again tomorrow.
"Altered", "Does not match seal" or "Seal invalid".
The check found a mismatch. Contact Lavawall support.
"Nothing to review".
Load some entries first; a review records the range you actually looked at.
"No matching operators" in Actor.
Only people who have acted in the console appear. Check the spelling or search by email.

Still need help?

Search the support centre, or contact our support team and tell us which page you were on:

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.