It tracks various user activities such as:

User creation, update, EULA acceptance, and deletion.

User authentication, including failed login attempts and locked accounts.

Welcome email send and resend.

2 factor authentication, including enable, disable, and generate.

Password changes.

Container creation, deletion, and changes to container settings.

Device creation, deletion, and changes to device settings.

Remote access, including channel creation, port forwards, failed host resolution, and SSO access.

Telephony user refresh.

Alert profile creation, deletion, and edits.

Importing and exporting threshold values.

Licensing changes, including attaching, detaching, and uploading licenses.

Offline licensing or updating LASS queries.

Probe operations such as generate install PIN, connectivity checks, SNMP, SSO connection, and upload Probe logs.

Schedule creation, update, and deletion for device operations, maintenance, and backup. Also including attaching and detaching devices to a schedule.

Alarm ticket information updates.

Alert Profile creation, update, and deletion.

Device threshold creation, update, and deletion.

Two-factor authentication, including user configured 2FA, recovery code generation, and recovery code invalidation.

Network diagram creation, update, and deletion.

Email report template creation, update, and deletion.

Email alert template creation, update, and deletion.

Manual and automatic refresh of teleuser information.

Select a service set view.

System configuration changes including; Twilio config, SMTP config, Mapquest API, and Elfiq Central preferences.

MSL device upgrade operations.

K8s device upgrade.

MiVoice Business maintenance command execution (MiXML commands).

As with other queries, Mitel Performance Analytics provides an initial set of audit log queries covering the past 24 hours, the past week, or the past month. You can also customize the duration of the audit log report. See "Audit Log Queries".

The following is typical audit log for a particular day.