Audit Trail

This page explains the audit trail system in Erik's ToolBox, which records user actions for accountability, compliance, and troubleshooting purposes. The audit trail provides a detailed log of who did what, when they did it, and what was affected.

Audit Trail Overview

Erik's ToolBox includes a built-in audit trail that automatically logs significant user actions across all ToolBox features. The audit trail is implemented through two key components:

Audit Trail table -- Stores the individual audit trail records, each representing a logged action performed by a user.
Audit Trail Mgt. codeunit -- The management codeunit that handles the creation of audit trail entries. This codeunit is called by various ToolBox features whenever a loggable action occurs.

The audit trail operates automatically in the background. You do not need to enable or configure it -- it is always active. Every significant action performed through the ToolBox is recorded, providing a comprehensive history of ToolBox usage in your environment.

What Is Logged

The audit trail captures a broad range of actions across the ToolBox feature set. The following categories of actions are recorded:

Code Execution Events

When a user executes a script in the Interactive Code editor
When a program is run from the Run Programs page
When a batch processing operation is executed

Data Modifications via Data Inspector

When a user inserts, modifies, or deletes records through the Data Inspector
When a GodMode user modifies records in protected or system tables
When bulk data operations are performed

Batch Processing Operations

When a search-and-replace batch operation is initiated
The scope and parameters of the batch operation
The outcome of the batch processing run

Remote Package Transfers

When data is sent to a remote environment via Remote Packages
When data is received from a remote environment
The tables and record counts involved in the transfer

GitHub Data Operations

When data is committed (pushed) to a GitHub repository
When data is pulled from a GitHub repository
When change monitoring detects and logs data changes
The tables and repositories involved in each operation

User Management Changes

When a new user is added to the ToolBox user list
When a user's access level is changed
When a user is deleted from the ToolBox user list

Configuration Changes

When ToolBox Setup settings are modified
When integration settings (Azure Storage, Remote ToolBox, GitHub) are updated

Audit Trail Record Fields

Each audit trail entry contains the following information:

Field	Description
Security User ID	The Business Central security ID of the user who performed the action. This identifies the user account that initiated the logged event.
Date/Time	The date and time when the action occurred. This timestamp is recorded in the server's local time zone.
Action Type	A classification of what type of action was performed (for example, code execution, data modification, user management change).
Details	Additional context about the action, such as the table affected, the number of records involved, or the specific operation performed.

These fields provide enough information to answer the key audit questions: who performed the action, when it happened, what type of action it was, and what data or configuration was affected.

Viewing the Audit Trail

You can access the audit trail from multiple entry points within the ToolBox.

From the ToolBox Setup Page

Open the ToolBox Setup page (requires SUPER role).
Navigate to the audit trail section or action to view the complete audit trail for all users.
The full audit trail list is displayed, showing all recorded actions across the environment.

From the User List

Open the ToolBox Users page (from the ToolBox Setup page, choose the Users action).
Locate the user whose audit trail you want to review.
The Audit Trail column displays a count of audit trail entries for that user. This is a FlowField that calculates the number of entries dynamically.
Click on the Audit Trail count to drill down into that user's specific audit trail entries.

This per-user view is useful when you need to review the actions of a specific individual, for example during a security review or when investigating an issue.

Filtering the Audit Trail

When viewing the audit trail, you can apply standard Business Central filters to narrow the results:

Filter by user -- Show only entries for a specific user by filtering on the Security User ID field.
Filter by date -- Show entries within a specific date range by filtering on the Date/Time field.
Filter by action type -- Show only specific types of actions by filtering on the Action Type field.

These filters can be combined to create targeted views. For example, you can filter to show only data modification actions performed by a specific user within the last 30 days.

How the Audit Trail Works

The Audit Trail Mgt. codeunit is the central component responsible for creating audit trail records. Here is how the process works:

A user performs an action in the ToolBox (for example, executing a script or modifying a record in the Data Inspector).
The ToolBox feature that processes the action calls the Audit Trail Mgt. codeunit.
The codeunit creates a new record in the Audit Trail table with the current user's security ID, the current date and time, the action type, and any relevant details.
The audit trail record is committed to the database.

This process is automatic and transparent. You do not need to take any action to trigger audit trail logging. The system handles it as part of the normal operation of each ToolBox feature.

GodMode and the Audit Trail

The audit trail is particularly important for tracking GodMode operations. When a GodMode user modifies records in protected or system tables, the audit trail provides the only record of those changes outside of the Business Central standard change log.

Key behaviors for GodMode audit logging:

All GodMode operations on protected tables are logged, including inserts, modifications, and deletions.
When a GodMode user modifies a protected table for the first time in a session, a warning confirmation dialog is displayed. This warning can be reset using the Restore GodMode warnings action on the ToolBox Users page.
The audit trail captures the specific table involved and the nature of the operation, providing a clear record for later review.

Because GodMode provides unrestricted access to all tables, including those that Business Central protects from normal modifications, the audit trail serves as a critical accountability mechanism. Administrators should review GodMode audit entries regularly.

Compliance

The audit trail supports a variety of regulatory and organizational compliance requirements.

Regulatory Compliance

SOX Compliance -- The audit trail provides evidence of data change controls, including who made changes and when. This supports Sarbanes-Oxley requirements for financial data integrity.
GDPR and Data Protection -- The audit trail records data access and modification events, supporting data protection regulations that require accountability for personal data processing.
Internal Audit Requirements -- The audit trail provides a detailed history that internal auditors can review to verify that data changes follow approved processes.

Data Integrity

Audit trail records cannot be deleted by non-admin users, ensuring the integrity of the audit history.
The audit trail provides an independent record of changes made through the ToolBox, separate from the Business Central standard change log.
The combination of user identification, timestamps, and action details creates a reliable chain of evidence.

Change Tracking

The audit trail complements the Business Central native change log by capturing ToolBox-specific operations that the standard change log may not track.
Together, the ToolBox audit trail and the Business Central change log provide comprehensive coverage of all data changes in your environment.

Combining with Business Central Change Log

The ToolBox audit trail and the Business Central native change log serve complementary purposes:

Aspect	ToolBox Audit Trail	BC Change Log
Scope	ToolBox-specific actions (scripts, data inspector, remote packages, etc.)	Standard Business Central operations (page edits, journal postings, etc.)
Granularity	Action-level (what operation was performed)	Field-level (which field was changed, old value, new value)
Coverage	All ToolBox features	Tables and fields configured for change logging
Configuration	Always active, no configuration needed	Must be enabled and configured per table

For comprehensive change tracking, you should use both systems together. The Business Central change log captures field-level detail for standard operations, while the ToolBox audit trail captures the broader context of ToolBox-specific operations.

Best Practices

Follow these best practices to get the most value from the audit trail:

Review the audit trail regularly -- Establish a schedule for reviewing audit trail entries, especially GodMode operations on protected tables. Weekly or monthly reviews are appropriate for most organizations.
Set up access levels to match organizational roles -- Proper access level assignment reduces the volume of sensitive operations and makes audit trail review more manageable. If most users have ReadOnly access, there are fewer data modification events to review.
Use audit trail data for security reviews -- When conducting security assessments, the audit trail provides evidence of who has been using the ToolBox and what they have been doing.
Archive old audit data periodically -- Over time, the audit trail table can grow large. Consider archiving older entries to maintain database performance while preserving historical records for compliance purposes.
Combine with the BC native change log -- For the most comprehensive change tracking, enable the Business Central change log for critical tables in addition to the ToolBox audit trail. This gives you both action-level and field-level visibility.
Document your audit review process -- Create a written procedure for who reviews the audit trail, how often, and what they look for. This supports compliance requirements that mandate documented controls.
Investigate anomalies promptly -- If you notice unusual patterns in the audit trail (such as unexpected GodMode operations or data modifications at unusual times), investigate them promptly to identify potential security issues.

Troubleshooting

Audit Trail Shows No Entries

If the audit trail appears empty, check the following:

Verify that ToolBox features have been used in the environment. If no actions have been performed, there are no entries to display.
Check your filters. You may have an active filter on the audit trail page that is excluding the entries you expect to see.
Confirm that you are looking at the correct environment. The audit trail is environment-specific.

Audit Trail Count Does Not Match Expected Value

The Audit Trail column on the ToolBox Users page is a FlowField. If the count does not seem correct:

The FlowField calculates the count dynamically. It should always reflect the current state of the audit trail table.
If you recently performed actions and the count has not updated, try refreshing the page.

Large Audit Trail Affecting Performance

If the audit trail table has grown very large and is affecting performance:

Consider archiving older entries to a separate table or exporting them to an external system.
Use date filters when viewing the audit trail to limit the number of records loaded on the page.