> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/for-devops-and-administrators/manage/logs.md). # Review activity logs Review activity with Devolutions CLI: export local logs, list Devolutions Cloud and Devolutions Server logs, and see the history of one entry. Activity logs tell you who opened, changed, or deleted what, and when. Devolutions CLI reads them from a terminal, so you can check an incident quickly or feed the logs to a script. Each workspace type keeps different logs, so the command depends on where you work. ## Pick the right command
WORKSPACECOMMANDWHAT YOU GET
Local Devolutions Remote Desktop Manager profiledevo admin logs exportA CSV file of the workspace's activity logs.
Local Devolutions Remote Desktop Manager profiledevo entry logsThe history of one entry.
Devolutions Serverdevo admin logs activity, administration, login-attempts, pam, rotationThe Devolutions Server reports, one command per report.
Devolutions Clouddevo admin logs archived, siemArchived log summaries for one day, and SIEM report logs.
Run a command on another workspace type and it stops with `operationNotSupportedBySource`. Check the selected workspace with `devo status`, or add `--context ` to the command. ## Export the logs of a local profile 1. Choose the report file. A local profile exports CSV only, so the path must end in `.csv`, in a folder that already exists. 2. Export, with the filters you need. Dates use the `yyyy-MM-dd` or `yyyy-MM-dd HH:mm` format: ```bash devo admin logs export --out-file activity.csv --after 2026-01-01 --before "2026-01-31 18:00" --entry-name "" ``` 3. Open the CSV file.
OPTIONWHAT IT DOES
--after, --beforeKeeps the logs of a period.
--entry-name, --group, --vault-idKeeps the logs of one entry, folder, or vault.
--sortSorts by connection, creationDate, or vault. Add --desc to sort in descending order.
--forceOverwrites the file if it already exists. Without it, the export stops with fileExists and keeps the existing file.
On a local profile, the other filters of the command (`--user`, `--machine`, `--message`, `--ticket`, `--open-comment`, `--close-comment`) and `--utc` are refused with `invalidParameterValue`. The export needs a profile that contains activity logs. If it doesn't, the command says so. ## See the history of one entry On a local profile, list the logs of a single entry: ```bash devo entry logs "" --start-date --end-date ``` Dates use the `yyyy-MM-dd` or `yyyy-MM-dd HH:mm` format. It returns up to 100 log lines by default. Change that with `--limit`. ## List Devolutions Server logs Each Devolutions Server report has its own command:
COMMANDREPORT
devo admin logs activityActivity logs. Filter with --vault-id, --user-id, and --message-type.
devo admin logs administrationAdministration logs.
devo admin logs login-attemptsSign-in attempts. Filter on one user with --username.
devo admin logs pamPrivileged Access Management activity. Add --include-pam-system for system events.
devo admin logs rotationPassword rotation logs.
Every report accepts the same period options: ```bash devo admin logs activity --date-filter last-7-days ``` * `--date-filter`: `today`, `yesterday`, `last-7-days`, `last-30-days`, `last-60-days`, `last-90-days`, `last-180-days`, or `custom`. * `--after` and `--before`: an exact period. * `--page` and `--page-size`: to read a long report in parts. A page holds up to 10000 log lines, which is also the default. ## List Devolutions Cloud logs ```bash devo admin logs archived --date 2026-01-31 devo admin logs siem --period weekly ``` `--date` uses the `yyyy-MM-dd` format. `--period` accepts `all` (the default), `daily`, `weekly`, or `monthly`. ## Good to know * Add `--output json` to process the logs in a script or send them to another tool. See [Read results as JSON](/cli/for-devops-and-administrators/automate/json-output.md). * All options of each command are in the [command reference](/cli/reference/commands.md). * A logs command says the workspace doesn't support it? See [A command says the workspace doesn't support it](/cli/help/troubleshooting/not-supported.md). ## Next * [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md) * [Collect diagnostics for support](/cli/help/troubleshooting/collect-diagnostics.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/cli/for-devops-and-administrators/manage/logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.