Audit Log
Append-only, and not editable from the console at any role.
What is recorded
Section titled “What is recorded”Human actions — sign-ins, server starts and stops, model registration and deletion, key creation and every key reveal, user and role changes, configuration changes, licence activation.
Decisions Lifeboat made on its own, which is the part worth knowing about, because these change how a server behaves without anyone touching a setting:
| Entry | Meaning |
|---|---|
server_backend_autoswitched |
The engine changed at start because the other one could serve those weights and this one could not. |
server_is_embedding_autodetected |
The model was identified as an embedding model, and every generation-only setting was stripped. |
server_tool_call_parser_corrected |
The configured tool-call parser did not match what the model’s own chat template proves it emits, and was corrected. Without this, tool calls fail silently. |
If a server behaves differently from how it is configured, search the audit log for its name before suspecting the configuration. That is the single most useful thing on this page.
Searching
Section titled “Searching”Filter by target — a server name, a model, a user — rather than scrolling. Time-bounded filtering narrows an incident quickly.
Alerts mirror it
Section titled “Alerts mirror it”Some entries also raise an informational alert so the two views agree about what happened: server started and stopped, downloads completed or failed, cluster created, sign-ins. See Alerts and health.
Retention and export
Section titled “Retention and export”Entries live in the data directory, so persist that volume or the log is lost with the container. Mount the log path to a host volume for retention beyond the container’s life, and ship it to your existing log platform if it needs correlating with anything else.
What it does not contain
Section titled “What it does not contain”No prompts, completions or request content. Lifeboat does not retain them, which is deliberate and is also why none of it appears in telemetry. If you need request-level governance and content inspection, that belongs in a governance layer in front of inference.
Sources and references
Section titled “Sources and references”- Posture: Security posture
- Alerts: Alerts and health
- Outbound data: Telemetry