Review audit logs in Analyzer in Sign

Last updated on Aug 17, 2026

Review user, administrative, and system activity across your organization.

The Audit logs page provides administrators with a searchable activity history for Analyzer. Use the audit report to investigate actions, review configuration changes, monitor processing activity, or export records for reporting and compliance.

What audit logs record

Audit events fall into three categories.

User activity

User events record actions performed by individual users, including:

  • Creating, editing, or deleting collections.
  • Creating or modifying attributes.
  • Running extraction or analysis processes.
  • Exporting extracted data.

Administrative activity

Administrative events record configuration changes, including:

  • Changes to general settings.
  • Changes to asset access.
  • User enablement or role updates.

System activity

System events record background operations, including:

  • Processing jobs.
  • System-generated updates.
  • Platform maintenance events.

Create an audit report

Go to Settings > Audit logs.

Select Audit Report.

Configure the report using the available filters:

  • Timestamp —  Define the time window you want the audit report to include. Data is available for the past 365 days.
  • Users — Select up to 10 users. This filter is available to administrators and supports search and multi-select.
  • Activity Type — Select the activity types to include. All types are selected by default.
  • Event Type — Select the event types to include. All types are selected by default.
  • Action — Select the actions to include. All actions are selected by default.
  • Status — Select the statuses to include. All statuses are selected by default.

Optionally select Include metadata column to include additional event details, such as before-and-after values, changed fields, and batch items.

The other fields show that an event happened and when. The metadata tells you what happened.

Audit report configuration showing filters for users, date range, event type, activity type, action, and status.
Combining filters can narrow a large activity history to the users, events, and time period relevant to an investigation or compliance review.

Select Download CSV.

Analyzer generates the report and downloads it to your local system.

Understand the exported report

The exported CSV includes:

  • Date & Time — Recorded with a UTC offset.
  • User (Email) — The user's email address or system@adobe.com for system activity.
  • Role — User, Admin, or System.
  • Activity Type — User-level, admin-level, or system-level activity.
  • Action — The action performed, such as Upload, Share, Delete, or Ingest.
  • Event Type — The affected object, such as Document, Collection, or Attribute.
  • Asset Name — The name of the affected asset.
  • Status — Success, Failed, or Pending for processing-related events.
  • Metadata — Optional context such as before-and-after values, changed fields, or batch items.

When one action affects multiple documents, the report groups the related document identifiers within the same event record.

Exported audit report showing event dates, users, roles, activities, actions, asset information, statuses, and metadata.
Each row represents an auditable event, while the optional metadata field can provide additional context about what changed.

Export limits

Each audit report can include:

  • Up to 10,000 events.
  • A date range of up to the last 12 months.

If you need additional records, use shorter or adjacent date ranges and export multiple reports.

Audit log retention

Analyzer retains audit history for 12 months by default.

Your organization's contractual agreement with Adobe may specify a different retention period.

What happens when personal information is deleted

Deleting personally identifiable information does not remove the associated historical audit events.

Instead:

  • Identifying fields are anonymized.
  • Event timestamps remain available.
  • Action details remain available.

This preserves the activity history while removing identifying information.