> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/admin-logs.md).

# Administration: logs

Every option of the devo admin logs commands: Devolutions Server reports, Devolutions Cloud archived and SIEM logs, and local profile log export.

This page describes the `devo admin logs` commands. Each one works with one workspace type, as the **Workspace** line under it says:

* **Devolutions Server**: `activity`, `administration`, `login-attempts`, `pam`, and `rotation` list the reports of the server.
* **Devolutions Cloud**: `archived` and `siem` list archived logs and SIEM report logs.
* **Local profile**: `export` writes the activity logs of a local profile to a CSV file.

A command run on another workspace type stops with `operationNotSupportedBySource` and names the type you need.

For the list of all commands, see [Commands](/cli/reference/commands.md). For step-by-step tasks, see [Review activity logs](/cli/for-devops-and-administrators/manage/logs.md). The options every command accepts, such as `--context` or `--output json`, are described in [Global options](/cli/reference/global-options.md) and aren't repeated here.

## Options shared by the Devolutions Server log commands

`devo admin logs activity`, `administration`, `login-attempts`, `pam`, and `rotation` accept these options. The section of each command says which ones it really uses.

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--date-filter &#x3C;preset></code></td><td><code>last-7-days</code></td><td>Period to report on: <code>today</code>, <code>yesterday</code>, <code>custom</code>, <code>current-month</code>, <code>last-month</code>, <code>last-7-days</code>, <code>last-30-days</code>, <code>last-31-days</code>, <code>last-60-days</code>, <code>last-90-days</code>, or <code>last-180-days</code>. Forms without hyphens, such as <code>last7days</code> or <code>currentmonth</code>, work too. When you leave it out, the report covers the last 7 days. Use <code>custom</code> with <code>--after</code> and <code>--before</code>.</td></tr><tr><td><code>--after &#x3C;date></code></td><td></td><td>Keeps only logs on or after this date or timestamp, for example <code>2026-10-01</code> or <code>2026-10-01T08:00:00Z</code>. A value without a time zone is read in local time. Passing <code>--after</code> switches the period to <code>custom</code>, whatever <code>--date-filter</code> says.</td></tr><tr><td><code>--before &#x3C;date></code></td><td></td><td>Keeps only logs on or before this date or timestamp. It must not be earlier than <code>--after</code>. On its own, <code>--before</code> doesn't change the period: add <code>--after</code> or <code>--date-filter custom</code> to report on your own range.</td></tr><tr><td><code>--filter &#x3C;text></code></td><td></td><td>Text filter applied by Devolutions Server, for the reports that support it.</td></tr><tr><td><code>--page &#x3C;number></code></td><td><code>1</code></td><td>Page to fetch, starting at 1.</td></tr><tr><td><code>--page-size &#x3C;size></code></td><td><code>10000</code></td><td>Number of log entries to fetch, from 1 to 10000.</td></tr></tbody></table>

## devo admin logs activity

Lists the activity logs of Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin logs activity [--date-filter <preset> | --after <date> --before <date>] [--vault-id <id> ...] [--user-id <id> ...] [--message-type <type> ...]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--date-filter</code>, <code>--after</code>, <code>--before</code>, <code>--filter</code>, <code>--page</code>, <code>--page-size</code></td><td></td><td>See <a href="#options-shared-by-the-devolutions-server-log-commands">Options shared by the Devolutions Server log commands</a>. All are used.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>All</td><td>Keeps only logs of this vault. Repeat the option for several vaults.</td></tr><tr><td><code>--user-id &#x3C;id></code></td><td>All</td><td>Keeps only logs of this user. Repeat the option for several users.</td></tr><tr><td><code>--message-type &#x3C;type></code></td><td>All</td><td>Keeps only logs of this message type. Repeat the option for several types. Devolutions CLI sends the values to Devolutions Server as you type them, without checking them.</td></tr></tbody></table>

## devo admin logs administration

Lists the administration logs of Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin logs administration [--date-filter <preset> | --after <date> --before <date>] [--filter <text>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--date-filter</code>, <code>--after</code>, <code>--before</code>, <code>--filter</code>, <code>--page</code>, <code>--page-size</code></td><td></td><td>See <a href="#options-shared-by-the-devolutions-server-log-commands">Options shared by the Devolutions Server log commands</a>. All are used.</td></tr></tbody></table>

## devo admin logs login-attempts

Lists the sign-in attempts recorded by Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin logs login-attempts [--date-filter <preset> | --after <date> --before <date>] [--username <name>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--date-filter</code>, <code>--after</code>, <code>--before</code>, <code>--page</code>, <code>--page-size</code></td><td></td><td>See <a href="#options-shared-by-the-devolutions-server-log-commands">Options shared by the Devolutions Server log commands</a>.</td></tr><tr><td><code>--filter &#x3C;text></code></td><td></td><td>Accepted, but not used by this report.</td></tr><tr><td><code>--username &#x3C;name></code></td><td>All</td><td>Keeps only the attempts of this user name, matched exactly but without case sensitivity. Devolutions CLI applies this filter to the page it receives, so a page can hold fewer entries than <code>--page-size</code>.</td></tr></tbody></table>

## devo admin logs pam

Lists the privileged access (PAM) activity logs of Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin logs pam [--after <date>] [--before <date>] [--vault-id <id>] [--user-id <id> ...] [--message-type <type> ...] [--credential-id <id>] [--include-pam-system]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--after &#x3C;date></code>, <code>--before &#x3C;date></code></td><td></td><td>Limit the logs to a date range. See <a href="#options-shared-by-the-devolutions-server-log-commands">Options shared by the Devolutions Server log commands</a>.</td></tr><tr><td><code>--page-size &#x3C;size></code></td><td><code>10000</code></td><td>Maximum number of log entries to fetch, from 1 to 10000.</td></tr><tr><td><code>--date-filter</code>, <code>--filter</code>, <code>--page</code></td><td></td><td>Accepted and checked, but not used by this report. Use <code>--after</code> and <code>--before</code> to choose the period.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>All</td><td>Keeps only logs of this privileged access vault. The option can be repeated, but only the first vault is used.</td></tr><tr><td><code>--user-id &#x3C;id></code></td><td>All</td><td>Keeps only logs of this user. Repeat the option for several users.</td></tr><tr><td><code>--message-type &#x3C;type></code></td><td>All</td><td>Keeps only logs of this message type. Repeat the option for several types. Devolutions CLI sends the values to Devolutions Server as you type them, without checking them.</td></tr><tr><td><code>--credential-id &#x3C;id></code></td><td>All</td><td>Keeps only logs of this privileged account.</td></tr><tr><td><code>--include-pam-system</code></td><td>Off</td><td>Also lists the events generated by the privileged access system itself. Without it, they're left out.</td></tr></tbody></table>

## devo admin logs rotation

Lists when the passwords of privileged accounts were last updated by Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin logs rotation [--date-filter <preset> | --after <date> --before <date>] [--vault-id <id> ...] [--credential-type <type> ...] [--include-no-password-update]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--date-filter</code>, <code>--after</code>, <code>--before</code>, <code>--filter</code>, <code>--page</code>, <code>--page-size</code></td><td></td><td>See <a href="#options-shared-by-the-devolutions-server-log-commands">Options shared by the Devolutions Server log commands</a>. All are used.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>All</td><td>Keeps only accounts of this vault. Repeat the option for several vaults.</td></tr><tr><td><code>--credential-type &#x3C;type></code></td><td>All</td><td>Keeps only accounts of this credential type. Repeat the option for several types. Devolutions CLI sends the values to Devolutions Server as you type them, without checking them.</td></tr><tr><td><code>--include-no-password-update</code></td><td>Off</td><td>Also lists accounts whose password was never updated.</td></tr></tbody></table>

## devo admin logs archived

Lists the archived log summaries of the Devolutions Cloud organization for one day, without secrets.

**Workspace:** Devolutions Cloud.

```bash
devo admin logs archived --date <yyyy-MM-dd>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--date &#x3C;yyyy-MM-dd></code></td><td></td><td>Required. Day to list, exactly in the <code>yyyy-MM-dd</code> format, for example <code>2026-10-01</code>. Any other format is refused.</td></tr></tbody></table>

## devo admin logs siem

Lists the SIEM report logs of the Devolutions Cloud organization, without secrets.

**Workspace:** Devolutions Cloud.

```bash
devo admin logs siem [--period all|daily|weekly|monthly]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--period &#x3C;period></code></td><td><code>all</code></td><td>Which SIEM reports to list: <code>all</code>, <code>daily</code>, <code>weekly</code>, or <code>monthly</code>. Case doesn't matter. Any other value is refused.</td></tr></tbody></table>

## devo admin logs export

Exports the activity logs of a local profile to a CSV file. Sensitive values are left out of the file. The profile must contain activity logs in a format Devolutions CLI can read; otherwise the command says the export isn't available for this profile.

**Workspace:** Local profile.

```bash
devo admin logs export --out-file <path.csv> [--after <date>] [--before <date>] [--vault-id <id>] [--entry-name <text>] [--group <text>] [--sort connection|creationDate|vault] [--desc] [--force]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--out-file &#x3C;path></code></td><td></td><td>Required. File to write. It must end in <code>.csv</code>, and its folder must already exist.</td></tr><tr><td><code>--format &#x3C;format></code></td><td>From <code>--out-file</code></td><td>Report format. Only <code>csv</code> works with a local profile; <code>html</code> and <code>xml</code> are refused. When given, it must match the file extension.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Overwrites the file if it already exists. Without it, an existing file stops the command.</td></tr><tr><td><code>--after &#x3C;date></code></td><td></td><td>Keeps only logs on or after this date, as <code>yyyy-MM-dd</code> or <code>yyyy-MM-dd HH:mm</code>, in local time.</td></tr><tr><td><code>--before &#x3C;date></code></td><td></td><td>Keeps only logs on or before this date, in the same formats. It must not be earlier than <code>--after</code>.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td>All</td><td>Keeps only logs of this vault.</td></tr><tr><td><code>--entry-name &#x3C;text></code></td><td>All</td><td>Keeps only logs whose entry name contains this text, without case sensitivity.</td></tr><tr><td><code>--group &#x3C;text></code></td><td>All</td><td>Keeps only logs whose entry folder (group) contains this text, without case sensitivity.</td></tr><tr><td><code>--sort &#x3C;field></code></td><td><code>creationDate</code></td><td>Sort order: <code>connection</code> (entry name), <code>creationDate</code>, or <code>vault</code> (vault name). Any other value is refused.</td></tr><tr><td><code>--desc</code></td><td>Off</td><td>Sorts in descending order.</td></tr><tr><td><code>--user &#x3C;name></code></td><td></td><td>Not supported for a local profile: the command stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--machine &#x3C;name></code></td><td></td><td>Not supported for a local profile: the command stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--message &#x3C;text></code></td><td></td><td>Not supported for a local profile: the command stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--ticket &#x3C;number></code></td><td></td><td>Not supported for a local profile: the command stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--open-comment &#x3C;text></code></td><td></td><td>Not supported for a local profile: the command stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--close-comment &#x3C;text></code></td><td></td><td>Not supported for a local profile: the command stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--utc</code></td><td>Off</td><td>Not supported for a local profile: the command stops with <code>invalidParameterValue</code>. Dates in the file stay as they are stored in the profile.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/admin-logs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.