Events

Admin → Events is the audit log. Every change made in the panel is recorded with the user, IP address and time — for example:

Event	Meaning
auth.login, auth.logout	A user signed in or out
site.created, site.deleted	Site lifecycle
site.vhost, site.security, site.ssl.letsencrypt	Configuration changes
database.created, database.password	Database changes
firewall.added, firewall.removed	Firewall changes
backup.started, backup.restored, backup.deleted	Backups
account.2fa.enabled	Security settings

Each row shows a plain description (for example Site went down), the subject, the raw event name, the user and the IP. A red dot marks outages and deletions, a green one creations and recoveries.

Filter the list by search (event name, subject or IP), category (site, files, auth…), user (or System for automatic events such as uptime checks) and site. The filters are kept in the address and in the page links, so a filtered view can be bookmarked or shared. The list shows 50 events per page (25 or 100 next to Export CSV at the top left); Export CSV downloads every event that matches the filters, not only the page. On the Root agent tab the search box filters the agent log.

The dashboard shows the latest six events for the sites you can see. Events older than 180 days are removed every night.

Root agent log

Switch to Root agent to see what actually ran on the server: every call to the root agent with its caller, duration, result and parameters, read from /var/log/xaxa-agent.log (newest first, the last 100; Show 100 more extends it up to 500). Passwords, keys, file contents and environment values are masked before they are written. The file is root-only and rotated weekly; five files are kept (about a month).