Repository navigation
Audit Logs
Five log screens, under Logs. All of them filter and export to CSV.
| Screen | What it records | Source |
|---|---|---|
| Connections | Remote sessions: who connected to which device, when, when it closed, and the session note | Reported by the RustDesk client |
| File transfers | Files sent and received during sessions | Reported by the RustDesk client |
| Alarms | Security events — see below | Client and console |
| Logins | Console sign-ins, successful and failed | Console |
| Console audit | Administrative actions taken in the console | Console |
Connections, File Transfers and Alarms are visible with View on the Logs role area. Logins and Console audit require Manage — they are the record of administrator activity, so they are held one level higher. See Roles.
CSV exports put an apostrophe in front of any value that starts with =, +,
-, @, a tab or a carriage return, so a spreadsheet shows it as text instead
of running it as a formula. Device names, file paths and notes come from remote
clients and could otherwise carry one. Since 1.10.0.
Since 1.10.0.
A RustDesk client can ask for a note when a session ends. Turn on Ask for note at end of connection in the client's Settings → General. The client only asks while it is signed in to the console. A note typed with the Note button during a remote-control session is stored too.
Notes show in the Note column of the connection log with the console user who
wrote them, under the session on the device page, in the CSV export (Note,
Note By) and in the Automation API. The
search box matches note text.
Since 1.11.0.
The RustDesk client logs files copied and pasted between machines with an
empty path. The log shows their names instead, with a Clipboard badge, and
search matches the names. The client names up to the 10 largest files of a
job; the Files column has the full count. The CSV export adds a File names
column.
Alarms come from two places. The RustDesk client reports its own security events, and the console raises its own for sign-in abuse.
Reported by clients:
- IP whitelist block
- Many failed attempts (>30)
- Rapid access attempts
- IPv6 prefix attempts exceeded
- Terminal login backoff
- Terminal login concurrency
- Session scope violation
- ID whitelist block: RustDesk 1.5.0 and later, when the controlled device's ID whitelist refuses the device connecting to it. Since 1.11.0; before that it showed as "Type 10".
Raised by the console:
- Console brute force — repeated failed sign-ins against one account
- Console password spraying — repeated failed sign-ins from one address across accounts
The console's sign-in limiter is per-account and per-address, so an attacker spreading attempts across many usernames still trips the address limit. Both raise an alarm, and both are rate-limited so a sustained attack does not flood the log with thousands of identical rows.
Connections that are still open appear on the dashboard, where an administrator can end one. See Dashboard and active sessions.
RustDesk 1.5.0 clients post an audit record again unless the server's answer
is empty. Up to 1.10.1 CortenDesk answered {}, so every connection, file
transfer and alarm from a 1.5.0 client was stored three times. The extra
connection rows stayed on the dashboard as active sessions that never ended.
1.11.0 answers the way the client expects and ignores a repeated record. To
remove the copies stored before you upgraded, run
cortendesk:dedupe-audits.
Settings → Maintenance → log retention days. Default 365. Set it to 0 to keep everything forever.
Retention covers all five logs. Pruning runs nightly on a schedule and deletes in chunks so it does not lock the tables on a large install. There is also a Prune now button in Settings, which reports how many rows it removed.
The nightly job needs the scheduler running:
- Docker — already running inside the container, nothing to do.
- Manual install — you must add the cron entry, or nothing is ever pruned. See Install on a VM.