There is no audit entry for something

Three records, one of which you are probably reading#

The audit trail exists because neither of the other two answers the question an auditor actually asks: who did this, in what capacity, to what, and did it work. Those six facts are the whole design, and the correlation id is what lets one decision and everything it caused be pulled back together months later.

Why an entry may not be there#

1. The action was not consequential. Reading a screen, opening a conversation, running a search — none of these change money, data, access or anything irreversible, and none is audited. They are not missing; they were never in scope.
2. It is in the activity record instead. Most of what Connect does day to day is there, written for a person to read rather than for an auditor.
3. It failed before it became an action. A refusal is recorded as a decision, but something that never reached the point of deciding leaves its trace in the diagnostic record.
4. The audit write itself failed. This is a designed outcome, not a gap: a failure to write an audit row is reported and swallowed. Losing the audit of a payment is bad; failing the payment because the audit row would not write is worse.
5. You are looking in another workspace. Audit entries are scoped like every other record, so the right query in the wrong workspace returns nothing.

What is recorded but not shown as you expect#

A credential

Recorded as having been set, never as its value. Every field goes through redaction at the one place that writes to disk, so a secret cannot reach the record even by accident.

A refusal

A decision, and recorded as one — including the rule it was refused under. An action that did not happen can still have an entry.

Before and after

What changed, by name and state, rather than a copy of the payload. If you expected the old value verbatim, you will find the state it was in instead.

What Connect completed#

The action itself. Auditing is deliberately subordinate to it: nothing is failed, delayed or rolled back because its audit row would not write, so an action with no entry has still been carried out and still has its consequences. Where the action was a refusal, the refusal was applied and the rule that caused it was the one recorded.

What Connect did not complete#

It did not write an entry for everything, and it does not reconstruct one afterwards. There is no backfill: a row that failed to write is gone, and the only trace is the report of that failure in the diagnostic record. It also does not record reads, so 'who looked at this' is not a question the audit trail answers.

What you can do#

1. Look in the activity record for the same time window.

   Result Most day-to-day work is there, and finding it settles the question without any further investigation.

2. Check the decision log for a refusal.

   Result An action that appears not to have happened often did not happen on purpose, and the rule is named.

3. If you have any related entry, take its correlation id.

   Result One id gathers the decision and everything it caused, which is usually more useful than the single entry you were looking for.

4. Confirm the workspace.

   Result Scoping applies to audit entries exactly as it does to records, so this is a two-second check that saves long ones.

What an administrator can do#

• Search the diagnostic record for a reported audit write failure at that time. That is where a swallowed failure surfaces, and it is the only place it does.
• Confirm whether the action is in the audited class at all — money, data, access, irreversibility. If it is not, the fix is a product decision rather than an incident.
• Where an action clearly belongs in the audited class and is not there, treat it as a defect in the auditing rather than in the action, and raise it with the correlation id of anything adjacent.

When to escalate#

Escalate when something with money, data or access attached has no entry in any of the three records. That combination is the one this section cannot explain away, and it should be investigated with the workspace, the actor and the time to the minute. A single missing entry alongside a reported write failure is understood behaviour and needs only to be noted.

Questions#

Related#

• Reviewing an incident, end to end
• Security and isolation
• What Connect may do
• Deriving control state from the log instead of storing it
• Troubleshooting
• Something will not delete