Every admin write op enters el_admin_operation_logs. Essential for compliance / triage / accountability.
Fields
- ts / admin_username / action (website.create / firewall-ip-rule.delete etc)
- target_kind / target_id / target_name
- client_ip / user_agent
- success / error_message / params_summary JSON
AI agent separate audit
el_ai_audit_log table separate from admin audit, with tool_name / risk_class / approval_state (approved/denied/timeout).
Security alert linkage
user.delete / firewall.bypass-enabled / licence.uninstall / system-service.uninstall mysql etc trigger immediate notifications (email / SMS / Telegram).
Compliance export
CSV / JSON export meets SOC 2 / ISO 27001 / China DJCP audit requirements.