Audit log
Every signal, check, approval and action, append-only, hash-chained and signed.
Audit log (/audit, g t) shows every event 3AM recorded, newest first (opening on the latest 1,000; a search or
filter reads everything): signals, each step of an investigation, every check and
its raw result, what changed in your systems, every model call, decisions, approvals, actions, outcomes, learning,
configuration changes. Filter by category, search with words or the query language
(type:keychain.* actor:console:ana, data.channel:slack, time>2026-10-01), filter by who did it, or enter an
incident id to see only that incident. Export as CSV (UTC). Open a row for the full record. The first page follows new events as they're written.
The badge at the top shows the result of verifying the whole log: ✓ verified · N events · N segments, or tampering detected.
What makes it tamper-evident
- Each event includes the hash of the one before it, so the events form a chain.
- The log is split into segments, and each closed segment is signed with the install's key.
- Verification recomputes every hash and checks every signature: an edited, deleted, inserted or reordered event is detected.
- Secrets and card numbers are redacted before anything is written. Model calls store a hash of the full prompt and a redacted copy.
Verify from the command line at any time:
podman exec 3am-core /opt/3am/3am-core ledger-verify /var/lib/3am/ledgerThe command exits 1 if anything was altered.
Nothing in 3AM edits or deletes it: the log is append-only. Every event type is listed in Audit events.
Learned
What 3AM has learned on your estate, how accurate it has been, and the learned fixes waiting for you.
3AM Doctor
Is 3AM itself healthy? Every check (core, licence, intake, models and their placement, connections, approvals, accuracy, the audit log, disk) with what to do, in the console, the CLI and the API.