Logs

Audit log of administrator actions and system log (journal).

Audit log

Access → Audit log shows who changed what and when. Recorded are:

• every mutating API request (create, change, delete, actions) of all areas, including failed and denied ones,
• logins and logouts including wrong passwords, the second login step and changes to HTTPS and two-factor login,
• terminal sessions (start and end).

Each entry contains time, administrator, client address, action (e.g. storage.pool.create), target (e.g. pool or share name), result (Done, Failed, Denied), HTTP status and, for errors, the error text. Passwords, keys and codes are never recorded.

Filters: full text search (all words must occur), administrator, area (first part of the action), result and period. Clicking a row shows details. Load older entries pages further.

Storage

/appdata/bunkerbox/data/audit/audit.log (directory 700, file 600), one JSON line per entry, append only. From 5 MiB on the file becomes audit.log.1 (older ones move up), 5 old files are kept. Example:

{"id":"…","at":"2026-11-02T09:14:03.120Z","action":"shares.create","user":"admin","ip":"192.168.1.50","target":"media","result":"ok","status":201,"errorKey":null,"details":null}

The files can be evaluated with jq, e.g. jq -c 'select(.result != "ok")' /appdata/bunkerbox/data/audit/audit.log.

Method	Path	Description
GET	/api/audit	?q=&user=&action=<prefix>&result=ok|failed|denied&from=&to=&limit=1..500&before=<cursor> -> AuditPage (newest first, nextCursor)
GET	/api/audit/facets	AuditFacets (administrators and areas that occur)

System log

System → System log shows the systemd journal of the machine (journalctl -o json), newest entries first.

• Filters: service (all units with journal entries), priority ("Warning and more severe" etc.), period (15 minutes to 7 days or everything) and text in the message (case-insensitive).
• Follow fetches new entries every 3 seconds (from the last seen journal cursor) and adds them on top; up to 3000 lines stay visible.
• Load older entries pages back from the oldest entry shown (300 per page).
• Errors and critical messages are marked red, warnings orange.

Unit names, cursors, times and the search text are validated and passed to journalctl as single arguments (search via --grep with escaped special characters). If journalctl lacks pattern matching, Bunkerbox filters itself over a larger window.

Method	Path	Description
GET	/api/logs	?unit=a.service,b.service&priority=0..7&since=&until=&q=&limit=1..2000&after=<cursor>&before=<cursor> -> LogPage (entries newest first, cursor of the newest entry, more)
GET	/api/logs/units	LogUnit[] (name and description)