Audit Log

An audit log is the tamper evident record of who did what in a control system and when, covering logins, configuration changes, mode switches, and every setpoint written.

Each entry names the user, the action, the time, the old and new values, and the source of the command, whether operator, schedule, algorithm, or remote dispatch. The log is append only and exported to a separate system so it survives the appliance. It is the evidence a cybersecurity reviewer asks for under IEC 62443 and NERC CIP, and the record an operator reads to explain why a battery did what it did.

Also called: Audit trail