Audit Logs
Five log screens, under Logs. All of them filter and export to CSV.
| Screen | What it records | Source |
|---|---|---|
| Connections | Remote sessions: who connected to which device, when, and when it closed | Reported by the RustDesk client |
| File transfers | Files sent and received during sessions | Reported by the RustDesk client |
| Alarms | Security events — see below | Client and console |
| Logins | Console sign-ins, successful and failed | Console |
| Console audit | Administrative actions taken in the console | Console |
Connections, File Transfers and Alarms are visible with View on the Logs role area. Logins and Console audit require Manage — they are the record of administrator activity, so they are held one level higher. See Roles.
Alarms come from two places. The RustDesk client reports its own security events, and the console raises its own for sign-in abuse.
Reported by clients:
- IP whitelist block
- Many failed attempts (>30)
- Rapid access attempts
- IPv6 prefix attempts exceeded
- Terminal login backoff
- Terminal login concurrency
- Session scope violation
Raised by the console:
- Console brute force — repeated failed sign-ins against one account
- Console password spraying — repeated failed sign-ins from one address across accounts
The console's sign-in limiter is per-account and per-address, so an attacker spreading attempts across many usernames still trips the address limit. Both raise an alarm, and both are rate-limited so a sustained attack does not flood the log with thousands of identical rows.
Connections that are still open appear on the dashboard, where an administrator can end one. See Dashboard and active sessions.
Settings → Maintenance → log retention days. Default 365. Set it to 0 to keep everything forever.
Retention covers all five logs. Pruning runs nightly on a schedule and deletes in chunks so it does not lock the tables on a large install. There is also a Prune now button in Settings, which reports how many rows it removed.
The nightly job needs the scheduler running:
- Docker — already running inside the container, nothing to do.
- Manual install — you must add the cron entry, or nothing is ever pruned. See Install on a VM.