SAT - Logs

Updated 1 hour ago by admin

Logs let you investigate what is happening in your tenancy. Use them to confirm an email was delivered, find out why a user didn't get a reminder, check who deleted an account, or pull a delivery record for your security team.

This guide walks through what each tab does and how to use it.

Before you start

All date filters use dd/mm/yyyy. The View button gives more detail than the initial row.

Investigating an email delivery (Emails tab)

Use the Emails tab when someone reports they didn't receive an email, or when you need proof a specific email was sent.

To check a simulation email
  1. Go to Emails -> Simulation Audit Logs.
  2. Enter the recipient address in Email / To Address.
  3. Set a Date From and Date To covering when you'd expect the email to have been sent.
  4. Leave Success blank if you're not sure of the outcome, or set it to filter for failures only.
  5. Click Search.
  6. Find the email in the results. Click the eye icon in the View column to open the full record, including SMTP status and any error returned by the mail server.

If the email isn't in the results at all, it was never sent. If it's there with a failure, the error field tells you why.

To check a course email
  1. Go to Emails -> Course Audit Logs.
  2. Enter the recipient address.
  3. Set a date range.
  4. Optionally filter by Message Type.
  5. Click Search and click the eye icon on the relevant row to open Log Entry Details, which shows the course name, the user's full name, and the tenancy the message came from.

Checking what was sent to a user (Activity tab)

Use the Activity tab when you need to confirm a user was sent a Simulations, a course, or a reminder, and what happened next.

To see which Simulations a user received
  1. Go to Activity -> Sent Simulations.
  2. Enter the user's email in User ID / Email.
  3. Add a date range and Failed Status if you're narrowing down a problem.
  4. Click Search.
  5. Scan the Date Sent, Campaign ID, and Date Failed columns. The Landing Page Clicked column tells you whether they engaged with the simulation; Linked Course ID shows any follow-up training that was attached.
To check course completion
  1. Go to Activity -> Sent Courses.
  2. Enter the user's email or a course name.
  3. Set Completed Status to filter for completed or outstanding courses.
  4. Click Search.
  5. Check Date Completed to see if they finished, and Correct for their score. A blank Date Completed means the course was sent but never finished.
To find out why a user didn't get a reminder
  1. Go to Activity -> Sent Reminders History.
  2. Find the batch that should have included the user, using the Date Time column.
  3. Click View on that row.
  4. In the Reminder Details modal, scroll to Skipped Email Details.
  5. Find the user's address in the list. The Reason column tells you why they were skipped, usually "No outstanding courses" or "Duplicate, already sent in this batch".

The top of the same modal shows the rules the batch ran under: Source, Days After, and Frequency, useful if you need to confirm the reminder schedule itself.

Auditing user account changes (Users tab)

Use the Users tab when accounts have changed and you need to know whether it was an automated sync or a manual admin action.

To confirm a sync ran
  1. Go to Users -> User Sync.
  2. Find the date you want to check in the Date Time column.
  3. Look for two rows from that date: an import line ("28 users imported") and a Sync Summary line totalling the changes.
  4. If both rows are there, the sync ran. If the Sync Summary shows all zeros, the sync ran but nothing in your directory changed, which is normal.
  5. If the import line is missing entirely, the sync didn't run and you should escalate.
To find out who deleted a user
  1. Go to Users -> User Activity.
  2. Scan the Status column for the deleted address. Each entry reads as a sentence, for example "admin@example.com deleted user@example.co.uk in the portal".
  3. The Requested by column on the right confirms which admin performed the action.

If a user has disappeared and you don't see a deletion entry here, the change came from a sync rather than a manual action; check User Sync next.

Common troubleshooting paths

  • "I never got the email": Emails -> Simulation or Course Audit Logs, search by recipient.
  • "Did this user complete their training?": Activity -> Sent Courses, search by user.
  • "Why wasn't I reminded?": Activity -> Sent Reminders History, find the batch, open Skipped Email Details.
  • "Who deleted this account?": Users -> User Activity, search the status column.
  • "Is the sync working?": Users -> User Sync, check for both rows on recent dates.

How did we do?