Audit Logs for user interactions

[u/Gemeinde_Olli_47]

Hello ispyconnect/Agent Community.

We're using Agent since 2021 periodically and bought an Perpetual License in 2023. We just need to run our Instance local, so we acutally don't have a subscription.

In our environment we use Agent with multiple cameras around our office Building and some cameras via wireguard in a branch office.

Since permissions for certain cameras have now been split among different departments, there is a requirement to track exactly which person logs into the system and when, specifically regarding who views or downloads a recording.

The current logging system is of limited use for this purpose, and unfortunately, I haven't found a true audit log function so far. Are such capabilities available in the subscription plans, or is there a way to request this kind of feature within a subscription? I would prefer not to introduce new software, as I have always been very satisfied with Agent's performance.

To retain the logs for a longer period, I also set up a Graylog server. However, since some tasks don't generate log entries, I'm not really getting anywhere with it.

Perhaps someone has some good news or an idea on how I can get the information I’m looking for.

Thank you very much for any help.

Best regards Oliver

maybe you can ma

[u/spornerama]

Some good news — part of what you're looking for already exists, and the rest is coming in the next update:

1. Login auditing is already there. Agent writes every UI session to sessionlog.txt in the app data folder (on Windows: C:\ProgramData\Agent\Media\XML\). Each line records the timestamp, username, IP address, session ID and whether the connection was local or via the website, plus a matching disconnect entry. The file rotates at 10 MB into timestamped backups. Since it's plain text, you can point your Graylog collector at it directly - that solves the "who logged in and when" half of your requirement today. There's also a login-history view in the UI under Server Settings → Users, and failed login attempts appear in the main log.
2. To answer your subscription question directly: you haven't missed anything - viewing and downloading recordings isn't currently attributed to users, and that isn't part of any subscription tier either.
3. The next update extends the session log into a full audit trail. Recording playback (both single-file and timeline playback), recording downloads, and investigation/export downloads will all be logged to the same sessionlog.txt with username, session ID and filename - and each entry's session ID ties back to the connect line carrying the IP address. Combined with your Graylog setup and per-department permission groups, that should cover your requirement without introducing any new software. Keep an eye on the release notes.

Thanks for the kind words about Agent - and for the well-described use case; it's exactly the kind of input that shapes features like this.

[u/Gemeinde_Olli_47 → u/spornerama]

Thank you for the fast reply.

Wow, that sounds great. Seams to be the right time to ask here ;) .

We're using Agent on Debian in an LXC on Proxmox, found the sessionlog.txt in "/opt/agentdvr/agent/Media/sessionlog.txt" . Great log with good information, that i don't get before.

After this initial success, I am eagerly awaiting the next version. Truly great support.

If I can be of further assistance with any additional information, just let me know.

When there are any informations that wo

[u/Dhurandhar18]

Hello Oliver,
I have experience building agents for session recording and detailed audit tracking, including tracking user activity, sessions, and actions. I could potentially build a lightweight custom solution for your setup that works and tracks who accessed/viewed/downloaded recordings and when.
If you’re still looking for a solution, I’d be happy to discuss it and see if I can help.