---
title: Viewing user logs
description: "Find users' sign-ins and actions, filter and export them, set the retention period and track sign-ins as another employee."
url: "https://illizeo.com/en/centre-aide/governance-user-logs/"
updated: "2026-11-05"
category: "Platform / Governance & security"
---

# Viewing user logs

User logs record the activity in your space: sign-ins and sign-outs, creations, changes and deletions, views of sensitive data, exports and signatures. This article explains how to filter, read and export them, set their retention period and track sign-ins as another employee. It is intended for administrators and the DPO.

## Before you start

- You need the "View activity logs" permission (Platform administration › Authentication section of the role matrix) at the **Access** level, and "Settings — Access". By default, only the Administrator role holds them.
- The retention period bar also requires "Activity log retention (GDPR)": **Access** to see it, **Execute** to change it.
- Permissions are set in **Settings › Manage Employees › Employee Roles**. See [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/).

## Opening the user logs

Open **Settings › Manage Illizeo › User Logs**. The "User Logs" page opens on the **User Activity** tab; the **Impersonation** tab is described below. At the top, a counter shows the number of events in the period, next to the **Refresh** and export buttons.

The "Activity logging notice" banner tells everyone who opens the page what is recorded and why: actions and sign-ins, with the timestamp, the user, their IP address and their session, for security and accountability purposes.

## What the log records

- **Sign-ins** and **sign-outs**, with the time the session opened and closed.
- **Creations**, **changes** and **deletions**, with the object concerned and, for a change, the old and new value of each field.
- **Views** of sensitive data, **exports** and **signatures**.
- A few automatic actions that matter to administrators, shown under "System" with the words "Automatic write": for example a failed SFTP import in the Budget module.

A secret (password, key, token) is never recorded with its value: the line only says "set" or "changed".

## Choosing the period and filtering

1. Choose the period in the **From** and **to** fields (DD.MM.YYYY format), or click a shortcut: **24h**, **7 days**, **30 days** or the retention period (for example **12 months**). A shortcut applies straight away.
2. Click **Add filter**. Choose the field, the operator ("equals", "contains" or "not equal to") and the value.
3. Add more filters if needed: they combine. Until they are applied, **Pending changes** is shown.
4. Click **Apply**. **Reset** removes the filters and returns to the longest period.

![The user log filter card: From to period with the 24h, 7 days, 30 days and 12 months shortcuts, an Email contains filter being entered, the Add filter link, the Pending changes label and the Reset and Apply buttons](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-user-logs-01.en_.png?resize=800%2C141&quality=80&ssl=1)
Add a filter, then Apply.

The fields you can filter on:

- **Role**, **Status** (Active, Inactive, On leave, Onboarding), **Email**, **User ID**, **First Name**, **Last Name**: they apply to the author of the action.
- **IP Address**, **Component** (the type of object affected), **Activity** (Created, Updated, Deleted, Viewed, Exported, Signed).
- **Module**: the module of the entry (Swiss payroll, Flex Office, Budget & payroll costs, Roles and permissions, etc.). The first value, "Time and absences (time management history)", groups all the time and absence logs.
- **Object ID** and **Employee concerned (ID)**: one specific object, or every entry about an employee, whoever the author. A person's ID is the number shown under their name in the User column.

## Reading the table

| Column | Content |
| --- | --- |
| Timestamp | The date and time of the event. |
| User | The author and their ID, or "System". |
| Email | The author's address. |
| Role | The author's roles. |
| IP Address | The address the action came from. |
| Component | The type of object affected, in plain words (for example "API token"). |
| Activity | The action (Created, Updated, Login, etc.), the object number, then up to four changed fields with their old and new value; beyond that, "+ n more". |
| Session | The sign-in time and the sign-out time, or "active" if the session is still open. |

The **Columns** button opens the list of **Visible columns**: untick the ones you do not need (at least one column stays on screen). **Show all** brings them back. The search field above the table filters the lines of the page on screen by name, email or IP address. The table shows 25 events per page.

![The Activity Log table with the Visible columns list open under the Columns button: ticked columns, Show all and Reset links](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-user-logs-02.en_.png?resize=800%2C500&quality=80&ssl=1)
The Columns button: choose the columns shown and exported.

## Exporting

Click the export button to the right of **Refresh**: Illizeo downloads an Excel file. Right-clicking the same button produces a CSV file. The file contains:

- all the events of the period and of the applied filters, not just the page on screen;
- only the columns visible on screen, so that no more data than necessary is extracted.

The search field is not taken into account. Each export is itself recorded in the log, with its period, filters and columns. Exports are limited to five per hour: beyond that, the message "Too many exports. Please wait before trying again." is shown.

## Setting the retention period

The **Retention period** bar shows how many months logs are kept. To change it, enter a value between 6 and 12 months, then click **Save**. There is no unlimited option.

- Every night, Illizeo permanently deletes ordinary entries older than this period: sign-ins, sign-outs and everyday changes.
- Tamper-evident entries (GDPR audit log, reads of sensitive data, chained records) are not deleted by this period.
- The change of period is itself recorded in the log, with the old and new value.
- The longest period shortcut follows the chosen period.

## The Impersonation tab

The **Impersonation** tab opens the "Impersonation Journal": every time someone signed in as another employee, with the "Impersonation access" permission, and every session opened by Illizeo support in your space.

- Columns: **Impersonator**, **Impersonated Employee**, **Started**, **Ended** (or "in progress"), **Duration**, **IP Address**, **Status**.
- Filters: **Period** (24h, 7 days, 30 days, 12 months, All) and **Status** (All, Active, Ended).
- The export button works as in the other tab.

![The Impersonation tab of the user logs: Impersonation Journal, Period and Status filters, table with the Impersonator, Impersonated Employee, Started, Ended, Duration, IP Address and Status columns, empty here: no session over 12 months](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-user-logs-03.en_.png?resize=800%2C336&quality=80&ssl=1)
The Impersonation tab: who signed in as another employee.

When someone signs in as another employee, their actions appear in the User Activity tab under that employee's name. The Impersonation tab tells you who was really acting and when. Setting this permission is covered in [Security & compliance](https://illizeo.com/en/docs-category/platform-en/platform-security-sso/).

## The time management history

**Settings › Time Management › Time management history** opens the same page, titled "Time management history", filtered on the time and absence logs: settings, on-call, public holidays, absences and clockings. It has no Impersonation tab. It requires the "Time management history (time and absence audit log)" permission; someone who only holds this permission only sees these logs, whatever filter they choose.

## Good to know

- The Role column shows the author's current roles, not the ones they held at the time of the action.
- A filter on a role or on the author removes the "System" lines.
- Automatic processes (purges, recalculations) do not appear here, with a few exceptions. Retention purges can be read in the [GDPR audit log](https://illizeo.com/en/centre-aide/governance-gdpr-audit-log/).
- For some modules, such as Swiss payroll, the line names the changed fields without their values.

## FAQ

### I cannot find an action from last year.

It is probably older than the retention period and has been deleted. Only tamper-evident entries remain beyond it.

### How do I see everything one person did?

Add the **Email** filter "equals" their address, then **Apply**. To see instead everything that was done about an employee, use **Employee concerned (ID)**.

### The "Too many exports" message appears.

You have reached the limit of five exports per hour. Wait, and narrow the period or filters to get the right file first time.

### *Similaire*