---
title: "View Access and Change Logs"
description: "How to find out who accessed what, and what was changed."
canonical: "https://docs.cm.com/governance/guides/customers/view-logs"
---

# View Access and Change Logs

> How to find out who accessed what, and what was changed.

Source: https://docs.cm.com/governance/guides/customers/view-logs

Governance keeps two logs:

- **Access log:** who tried to do what, and whether it was allowed.
- **Change log:** who changed access settings, and what changed.

You can view both in the Governance portal. You need the Governance **Editor** permission.

## Use the logs

1. Open the access log or the change log.
2. Choose a **time range**.
3. Page through the results. You can show 1 to 100 rows per page. The default is 50.
4. To keep a copy, export the results to CSV.

Logs are kept for 3 months. See [Data retention](https://docs.cm.com/governance/guides/data-retention).

## Access log

| Column | Shows |
| - | - |
| Time | When the check happened. |
| Principal | The user, team or token that asked. |
| Application | The application involved. |
| Permission | What was requested. |
| Decision | Whether it was allowed or denied. |

## Change log

| Column | Shows |
| - | - |
| Time | When the change happened. |
| Actor | Who made it. |
| Type | What was changed: a role assignment, team, team member, custom role, invitation or onboarding. |
| Action | Create, update or delete. |
| Target | The name of what changed. |
| Before and after | The previous and current state. |

## Related

- [Data retention](https://docs.cm.com/governance/guides/data-retention)
- [How access decisions work](https://docs.cm.com/governance/guides/how-access-decisions-work)