Log System tracks admin actions, model calls, authentication, orders and payments, conversation runtime events, and system events. It helps administrators investigate issues, audit high-risk actions, check usage cost, and locate abnormal behavior.

Entry Point#

Open Logs in the admin console. The log center has six tabs: Audit, Model calls, Authentication security, Orders, Conversation events, and System events.

Each log type supports search, filtering, sorting, and detail view. Start with a time range, then narrow by user, resource, model, order number, or event type.

Audit Logs#

Audit logs record admin and important user operations, such as create, update, delete, enable, disable, role change, status change, conversation sharing, project movement, file updates, and settings saves.

Filter by actor, action, resource, result, and time range. Details show actor, resource, request marker, time, and event details, making it easier to answer who changed what and when.

Model Calls#

Model calls record model requests and billing information. They can be searched or filtered by user, platform model, upstream model, upstream name, binding code, protocol, billing mode, and time range.

Common sorting includes call time, cost, tokens, and latency. Sort by cost for abnormal spend, tokens for long-context problems, and latency for performance issues.

Call details show platform model, upstream source, real model, tokens, cache, billing items, total cost, latency, call count, and raw usage JSON. Use them to verify pricing, investigate balance consumption, and confirm route selection.

Authentication Security#

Authentication security logs record sign-in, registration, refresh, verification, failures, lockouts, and related identity events. They are useful for login failures, locked accounts, identity provider problems, and suspicious sign-ins.

When a user cannot sign in, check authentication security first, then compare account status, auth settings, email verification, and identity bindings.

Orders#

Orders show subscription, renewal, upgrade, top-up, and other payment-related records. Search or filter by order number, user, type, provider, status, and time range.

For payment issues, inspect order status, provider, amount, created time, and paid time, then compare user entitlements or balance changes before deciding whether manual action is needed.

Conversation Events#

Conversation events capture key steps in a chat run, such as model requests, tool calls, file retrieval, RAG evidence, context compression, and task state.

Use them to answer questions like why the model responded that way, whether a tool ran, whether files were retrieved, or whether context was compressed. Filter by user, conversation, message, scope, tool, run ID, and status.

System Events#

System events record important platform events, warnings, and errors. They can be searched and filtered by source, event, resource, level, and time range.

Use system events for file processing, vectorization, async tasks, external service connectivity, model failures, and runtime exceptions. Higher severity deserves earlier attention.

Log Details#

Click a log row to inspect details. Details are grouped by event, actor, request, user, resource, call, model route, usage billing, orders, and conversation events depending on log type.

Detailed JSON content is useful for administrators but should not be shared broadly. Treat user, model, resource, order, and internal context information according to your data policy.

Practical Tips#

Use the order “time range -> user or model -> event type -> details” when investigating. Use model calls and orders for cost, authentication security for account safety, audit logs for configuration changes, conversation events for single-response behavior, and system events for background task failures.