Audit trail
Every authentication event is recorded in the audit timeline. Events relevant
to account management are tagged with the event:auth.* prefix:
| Event tag | What it records |
|---|---|
event:auth.login |
Successful login (username, IP, session ID) |
event:auth.logout |
Explicit logout |
event:auth.login_failed |
Failed login attempt (username, IP) |
event:auth.password_reset |
Password changed via reset script or UI |
event:auth.sessions_revoked |
Force-logout of all sessions for a user |
event:auth.user_created |
New user account created |
event:auth.user_deleted |
User account deleted |
To review auth events: open the audit timeline and click the Logins chip at
the top to filter to event:auth.* entries only. Each entry shows the
timestamp, the acting user or system process, the affected username, and the
source IP where applicable.
For incident response, the raw audit log is also written to:
/var/lib/quantum-controller/audit.logThis file is append-only during normal operation and survives service restarts.