Activity and audit log

FusionTerm records who did what: sign-ins (and failed attempts), connections opened and closed, host keys trusted or rejected, tunnels, file changes made with sudo, sharing and access changes (folders, vault, individual sessions), refused Net Tools and HTTP checks, and account and settings changes.

• Your own activity: Settings → Audit log.
• Everyone's (admins): Settings → Audit log → Everyone. Filter by username, action (end it with * to match a group, such as session_*), text in the details and dates; Show older pages back. Export CSV downloads the matching entries (up to 10,000) for an auditor or a spreadsheet — the export is itself recorded.
• One person's (admins): Settings → Users → Manage next to the person — their recent activity is at the bottom.

Each entry shows when it happened, who did it (their FusionTerm account), what it was, details (such as the server) and the address it came from. Passwords, keys and keystrokes are never recorded. Times in the CSV are in UTC.

#Session recording (admins)

Settings → Audit log → Everyone → Session recording records SSH terminals so you can see later what happened on a server:

• Record: Nothing (the default), Shared connections (connections in shared folders and connections people shared with someone) or Every SSH connection. Keep for sets how many days recordings are kept (default 90); older ones are deleted automatically.
• What's recorded is what the server showed in the terminal, with timing and window size — not what people type, so passwords typed at prompts aren't captured (a command people type normally appears anyway, because the server echoes it). RDP, VNC and Telnet aren't recorded.
• People see "this session is recorded by your administrator" in their terminal and a recorded badge on the tab.
• Recordings are encrypted on the server with the same key as saved passwords. Only admins can Play, download (as an asciinema .cast file) or delete them, and each of those is recorded in this log.
• Each recording names the FusionTerm person who opened the connection — so even when several people use the same server account, you know who it was.

#Send a copy to your SIEM (admins)

Settings → Audit log → Everyone → Forwarding to a SIEM · access review: enter your syslog server, port and protocol (UDP, TCP or TLS — use TLS across untrusted networks), tick Forward audit entries and Save. Send a test entry sends an audit_forward_test entry so you can find it on the other side.

Each entry is an RFC 5424 syslog message from fusionterm (facility local0; failures and refusals as warning, the rest as notice) with the action, user, user id and address as structured data and the details as the message. Works with rsyslog, syslog-ng, Graylog, Splunk, Wazuh, Elastic and most SIEMs. If the server is unreachable, entries wait in memory (up to 5,000) and FusionTerm keeps retrying; the status line shows what was sent, waiting or dropped. Forwarding never slows down or blocks anything people do.

#Access review (admins)

Download access review (CSV) in the same place lists every person — account role, active or disabled, how they sign in — with everything they can reach: shared connection folders (and their role), connections shared with them directly, shared vault folders, and any end dates. Use it for a regular "who still needs this?" review. Downloading it is recorded in the log.

#What the log can and can't tell you

The log records the FusionTerm person who opened each connection, even when several people sign in to a server with the same Unix account. It does not record the commands typed inside a terminal — turn on session recording for that. On the server itself, everyone using a shared account looks the same — give people their own server accounts or keys if you need per-person records there.

#How long entries are kept

One year by default; older entries are removed automatically. Change it with the environment variable FUSIONTERM_AUDIT_RETENTION_DAYS (for example 730 for two years, 0 to keep everything).

Entries can't be edited or deleted from FusionTerm. Deleting a user keeps their entries. Anyone with access to the server's files or database can still change them, so for tamper-evidence forward them to a syslog/SIEM server (above) or keep regular CSV exports somewhere they can't reach.