> ## Documentation Index
> Fetch the complete documentation index at: https://docs.erstan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log and usage

> Review the workspace audit trail and keep an eye on agent usage and estimated cost.

Erstan keeps a tamper-evident record of what agents and people do in your workspace, plus a running view of token usage and estimated cost. Both surfaces are for **Owners and admins** — members do not see them.

<Note>
  The Audit and Analytics pages require the **admin** permission. If you open them without it, Erstan shows an "Admin access required" message instead of data.
</Note>

## The audit log

The **Audit** page (under Admin) is the workspace's system of record. It shows every significant event across runs, tools, connectors, approvals, and sign-ins, with filters, a per-event detail drawer, and CSV export.

A summary strip at the top totals the selected time range: **Runs**, **Tool events**, **Queue jobs**, **Approvals**, **Tokens**, and **Integrations**. Use the range selector (**24h / 7d / 30d / 90d**) to scope everything on the page.

### What is recorded

The log is organized into tabs, each a different class of event:

| Tab              | What it captures                                                                                                     |
| ---------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Integrations** | Connector events — connect, authorize, refresh, disconnect — with the actor, outcome, and any OAuth or error reason. |
| **Usage**        | Per-run LLM usage: the agent, who started it, model breakdown, input/output/total tokens, tool calls, and runtime.   |
| **Tools**        | Individual tool calls with their source, status, duration, and any error — including NetSuite actions.               |
| **Queues**       | Queued tool jobs (such as the "NetSuite is busy" queue), with attempts, retry time, and last error.                  |
| **Approvals**    | The human-in-the-loop approval ledger: each request, who approved or rejected it, and a hash chain.                  |
| **Logins**       | Authentication events with the provider, outcome, user, and a hashed IP — no raw IP is stored.                       |
| **Runs**         | Every agent run with status, team, who started it, the **Run as** identity, runtime, and token totals.               |

<Note>
  The **Approvals** tab is a hash-chained ledger — each entry carries a sequence number, its own hash, and the previous hash. Erstan marks a row **Verified** or **Broken** so you can confirm the approval history has not been altered.
</Note>

### Reading and filtering

<Steps>
  <Step title="Open Audit">
    Go to **Admin → Audit**. Pick the tab for the event class you want and set the time range.
  </Step>

  <Step title="Narrow the results">
    Filter by **search text, workspace, user, agent, integration, tool, status,** or **event type**. On the Tools tab you can show **errors only**. Active filters appear as chips you can remove individually, or use **Clear** to reset.
  </Step>

  <Step title="Open an event">
    Select any row to open the detail drawer. It shows the full event payload, and for tool events the call, result, and any NetSuite queue job; for approvals it shows the ledger chain.
  </Step>

  <Step title="Jump to the run">
    When an event belongs to a run, use **Open run** in the drawer to go straight to that run's step-by-step trace.
  </Step>

  <Step title="Export">
    Use **Download CSV** to export the current tab and filters for offline review or sharing.
  </Step>
</Steps>

<Tip>
  This is the same trail you reach from a single run via **Audit in Erstan** on the [run history and traces](/agents/run-history-traces) page — the run links into the audit log, and the audit log links back to the run.
</Tip>

<Warning>
  The audit log records write actions to NetSuite and other systems regardless of how they were approved — including writes that were **auto-approved**. Review the Approvals and Tools tabs periodically so auto-approve never becomes a blind spot. See [Security & write safety](/security/overview).
</Warning>

## Usage and cost

You can see how much your agents are spending in two places.

<CardGroup cols={2}>
  <Card title="Audit → Usage" icon="database">
    Per-run token usage with a model breakdown, input/output/total tokens, tool-call counts, and runtime — filterable by agent, user, and range.
  </Card>

  <Card title="Agent analytics" icon="chart-line">
    A workspace overview of feedback, positive rate, total tokens, and estimated cost in USD, with top agents and recent feedback.
  </Card>
</CardGroup>

### Agent analytics

The agent **Analytics** view (admin only, reached from the Agents area) summarizes chat-agent activity over a **7-day, 30-day, or 90-day** range, optionally filtered to a single agent.

It shows four cards:

* **Feedback** — total thumbs up and down collected on agent replies.
* **Positive Rate** — thumbs up as a share of all feedback.
* **Tokens** — total tokens, split into input and output.
* **Estimated Cost** — an estimate in USD across the usage events in range.

Pick a single agent to also see its **Recent Feedback** (with the rated response and a link to open the execution or thread), and review **Top Agents by feedback volume** for the whole workspace.

<Info>
  Cost figures are **estimates** derived from token usage and model pricing, not a billing invoice. Treat them as a directional guide for spotting heavy agents, not an accounting source.
</Info>

### Team content footprint

Token usage and cost live in the two surfaces above. For a team's **storage** footprint, open the team's **Settings** and find the **Workspace usage** section: it lists the team's **Documents**, **Files**, and **Storage used** — handy for spotting a team that is accumulating large attachments. This is a content count, not a token-cost figure. See [Managing a team](/teams/managing).

## Good practices

<AccordionGroup>
  <Accordion title="Review approvals and writes regularly">
    Scan the **Approvals** and **Tools** tabs on a cadence (weekly is a reasonable start). Confirm approval rows read **Verified**, and look for write actions that ran without an explicit approval.
  </Accordion>

  <Accordion title="Watch for runaway cost">
    Sort the **Usage** tab by tokens, or use **Top Agents** in analytics, to find agents consuming far more than expected — often a sign of an over-broad prompt or a loop.
  </Accordion>

  <Accordion title="Investigate connector and login failures">
    Filter **Integrations** and **Logins** by failed outcomes to catch expiring NetSuite authorizations or unexpected sign-in attempts before they disrupt agents.
  </Accordion>

  <Accordion title="Export before you change things">
    Download a CSV of the relevant tab before a major workspace change so you keep a point-in-time record.
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Run history & traces" icon="route" href="/agents/run-history-traces">
    Read a single run's step-by-step trace and open it in the audit log.
  </Card>

  <Card title="Security & write safety" icon="shield-check" href="/security/overview">
    How approvals, write policy, and per-user authorization keep you in control.
  </Card>

  <Card title="Approving AI actions" icon="circle-check" href="/chat/approvals">
    Review write actions before they run, and when to auto-approve.
  </Card>

  <Card title="Workspaces and people" icon="users" href="/admin/workspaces-people">
    Manage the members whose activity appears in the audit log.
  </Card>
</CardGroup>