> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/cipp/logs.md).

# Logbook

The Logbook records every action CIPP performs, whether triggered by a technician, a scheduled task, an alert, or a background process. It is the primary tool for monitoring and troubleshooting, letting you confirm that an operation ran, see why one failed, and trace what CIPP was doing at a given moment.

Opening the Logbook needs the `CIPP.Logs` permission. The built-in roles all carry it, but the sign-in permission on its own does not, so a custom role must be granted it explicitly.

By default the table shows entries for the current day only, newest first, across every tenant your role gives you access to. To narrow it to the tenant selected in CIPP, turn on **Only show logs for** in the filters. Entries CIPP records against itself rather than a customer are always included.

## Using the Logbook for Troubleshooting

You can verify whether a specific action occurred by checking the log entries. For example, to confirm that the scheduled task "Hudu Extension Sync" ran successfully, select the appropriate date, filter or search for `Hudu Extension Sync`, and review the entries returned.

{% hint style="warning" %}
If an expected action is not logged, it might indicate a failure that occurred before the data was collected. If an alert is expected but not present in the logbook, it could indicate a failure in the data collection process. Such issues typically require developer intervention for identification and resolution. If you have an active subscription, please reach out to the helpdesk in these cases.
{% endhint %}

## Logbook Filters

Expanding the **Logbook Filters** section at the top of the page reveals the options for narrowing what is retrieved. The section header shows the date currently in effect, or a summary of the active filters once any are applied.

| Field                 | Description                                                                                                                                                                                                       |
| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Search messages       | Finds entries whose message contains the text, across every page of results rather than only the rows already loaded.                                                                                             |
| Today · 2d · 7d · 30d | Quick ranges ending today. **2d** is yesterday and today. Choosing one clears any dates you picked.                                                                                                               |
| Select Start Date     | The first day to retrieve entries for. Leave both dates empty to show the current day.                                                                                                                            |
| Select End Date       | The last day to retrieve entries for. Requires a start date, and must fall on or after it.                                                                                                                        |
| Filter by Username    | Restricts results to entries recorded against a particular user.                                                                                                                                                  |
| Filter by Severity    | Restricts results to one or more severity levels. Several can be selected at once.                                                                                                                                |
| Filter by API         | Restricts results to entries from particular APIs, matching the **API** column. Type the API names to filter on. Several can be added, and entries from any of them are shown. Part of a name is enough to match. |
| Filter by IP address  | Restricts results to entries from an IP address. Part of an address is enough to match.                                                                                                                           |
| Filter by App ID      | Restricts results to actions made by a particular API client or integration, matching the **AppId** column.                                                                                                       |
| Only show logs for    | Restricts results to the tenant currently selected in CIPP. Unavailable while All Tenants is selected.                                                                                                            |

| Button        | Description                                                              |
| ------------- | ------------------------------------------------------------------------ |
| Apply Filters | Runs the query with the chosen filters and collapses the filter section. |
| Clear Filters | Resets every field and returns the table to the current day.             |

Applied filters are kept in the page address, so a filtered view can be bookmarked or shared, and opening that link shows the same results.

{% hint style="info" %}
Log entries are partitioned by date, and the day boundary follows your CIPP instance rather than your own location. The filter panel shows how far your local time is offset, which is worth checking when an entry you expect near midnight appears on the neighbouring day.
{% endhint %}

{% hint style="warning" %}
Selecting a range of more than ten days produces an on-screen warning, because large ranges can time out or error given the volume of data being processed. Narrow the range if you run into problems.
{% endhint %}

{% hint style="info" %}
Debug entries are excluded unless you explicitly select Debug in **Filter by Severity**. If you have enabled Debug Mode to chase a problem and cannot see the output, this is usually why.
{% endhint %}

## Table Details

| Column    | Description                                                                                                                           |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| Date Time | The exact time the action was logged.                                                                                                 |
| Tenant    | The primary domain of the tenant the action relates to, or CIPP for platform-level entries.                                           |
| User      | The user associated with the action.                                                                                                  |
| Message   | A brief description of the action performed.                                                                                          |
| API       | The API endpoint or function that produced the entry.                                                                                 |
| Severity  | The severity level of the entry, as described below.                                                                                  |
| App Id    | The application ID of the API client that made the request, where the action came through an API client rather than a signed-in user. |
| IP        | The source IP address the request came from, where available.                                                                         |
| Log Data  | Additional structured data attached to the entry, where the logging call supplied any.                                                |

## Table Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>View Log Entry</td><td>Opens the full <a data-mention href="/user-documentation/cipp/logs/logentry.md">View Log Entry</a> page for the selected entry, including any associated standard, template or scheduled task details. Selecting a row opens the same page.</td><td>false</td></tr></tbody></table>

## Logbook Severity

| Severity | Description                                                                                                                                                                                                                                      |
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Alert    | A notable event that warrants proactive notification. Entries with this severity come from any alerts set up in [Alert Configuration](/user-documentation/tenant/administration/alert-configuration.md).                                         |
| Error    | The operation failed. The requested action could not be completed, typically due to an API failure, missing permissions, or an invalid request.                                                                                                  |
| Info     | The operation completed successfully. Informational messages confirming an action was performed as expected.                                                                                                                                     |
| Warning  | The operation completed, but with a caveat. Something may need attention even though the action wasn't blocked. Example: resetting a password on a directory-synced user warns that password writeback must be enabled.                          |
| Critical | A platform-level failure occurred. Reserved for situations where CIPP's own infrastructure is impacted, such as failures retrieving tenant lists or GDAP relationships. These indicate a problem with CIPP itself, not a specific tenant action. |
| Debug    | Diagnostic information for troubleshooting. Only recorded when Debug Mode is enabled. Not included in notifications by default, and not returned unless Debug is selected in the severity filter.                                                |

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cipp.app/user-documentation/cipp/logs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.