Security

What Is Audit Trail?

A chronological record of every action an AI agent takes, providing accountability, compliance evidence, and forensic capability.

In Plain English

An audit trail logs everything: what the agent did, when, why, and what the outcome was. Tool calls, message sends, file accesses, approval decisions — every event gets a timestamped, searchable record.

This is not just logging. An audit trail is structured, queryable, and exportable. When a customer asks "what did the agent do with my data?" you can answer with evidence.

For compliance (SOC 2, HIPAA, GDPR), audit trails are mandatory. For operations, they are invaluable for debugging and improving agent behavior.

Why It Matters for OpenClaw

Without an audit trail, you have no idea what your agent did. When something goes wrong — and it will — you need to reconstruct the sequence of events. Audit trails provide accountability, enable debugging, and satisfy compliance requirements.

How Clawctl Helps

Clawctl logs 50+ event types with full-text search and export (CSV/JSON). Retention: 7 days (Starter), 90 days (Team), 365 days (Business). SIEM export on Business plans for integration with Splunk, Datadog, and other tools.

Try Clawctl — 60 Second Deploy

Common Questions

What events are logged?

50+ event types including tool calls, message sends, approval decisions, policy violations, login events, configuration changes, and more.

Can I search the audit trail?

Yes. Full-text search across all events. Filter by event type, time range, agent, and user.

How long are logs kept?

Starter: 7 days. Team: 90 days. Business: 365 days. Enterprise: custom retention.