Event log
The organization-wide audit trail: what is recorded, who the actor was, how long it is kept, and where to look when something failed.
Certificate automation only helps if you find out when it stops working. aethercert records what happened in three places, at three levels of detail.
| Where | What it answers | |
|---|---|---|
| Event log | Monitoring > Event Log | What happened in this organization, and who or what did it. |
| Job history | Manage > Jobs | What each individual issue, renew, deploy or revoke attempt did, and why it failed. |
| Agent logs | Files on the agent host | What the agent did locally - the reload command's output, the file it wrote. See Logs and diagnostics. |
What is recorded
Every issuance, renewal, deployment and administrative action is appended to an organization-wide log. It is append-only: there is no edit and no delete, including for owners.
Each entry carries a timestamp, an actor (a user, an agent, or the system), an action, the object it affected, and a human-readable message.
| Area | Examples |
|---|---|
| Certificates | Created, updated, revoked, deleted; the external inventory being refreshed; a renewal being scheduled. |
| Jobs | Created, succeeded, failed, retry scheduled, deleted - each tied to its certificate. |
| Deployments | Started, succeeded, failed, retried; a rollback starting and completing. |
| Deploy targets | A saved target created, updated or deleted. |
| Agents | Enrolled, re-enrolled, updated, deleted; going offline and coming back. |
| Agent groups and policies | Created, updated, deleted; a policy applied to a member. |
| Domains | Created, verified, DNS provider configured, deleted. |
| Certificate authorities | Created, updated, deleted; a CA connector pairing; a sign authorization granted, denied or replayed. |
| CA health | CRL and delta-CRL expiry, CA certificate expiry, an unreachable CDP, an ESC6 finding. |
| Fleet updates | A host's update failing, rolling back, or failing repeatedly. |
| Email notifications | Mail apps created, enabled, disabled; a notification sent or failed. |
| Access | Sign-in and sign-out; a second-factor reset requested and confirmed. |
| Organization | Members and invitations, SSO changes, customer workspaces created. |
| Billing | Subscriptions synced or cancelled, a payment failing, MSP slots bought, assigned or released. |
Settings > Organization > Audit log shows the same trail filtered to the security- and configuration-relevant entries, which is usually the shorter list you want during a review.
Retention
The window is set by your plan, and it is enforced twice: the page will not show anything older, and a nightly job physically deletes it.
| Plan | Event log retention |
|---|---|
| Free | 7 days |
| Standard | 30 days |
| Pro | 90 days |
| MSP, MSP Plus | 90 days for the MSP's own workspace. Each customer workspace keeps the window of its own tier. |
Deletion is real. If you need a longer trail than your plan keeps, export what matters before it ages out. Finished jobs are purged on the same schedule.
Which events are alert-worthy
The log records far more than is worth paging on. A curated subset is classified with a severity and pushed to whatever monitoring integrations you have configured; everything else stays in the log only.
| Severity | Examples |
|---|---|
| Critical | A job failed after its retries, a deployment failed, a CRL or CA certificate has expired, an ESC6 misconfiguration was found on a CA, a host's update failed. |
| Warning | An agent went offline, a certificate expires within 14 days, a certificate was revoked, a deploy target was changed, a CA was changed, a CRL expires soon, a CA connector denied a sign request. |
| Info | An agent came back, an expiry was resolved, an agent enrolled. |
Routine bookkeeping - a certificate renamed, a job queued, a domain verified - is deliberately not pushed. An action nobody has classified defaults to info, not pushed, so a new kind of event never starts paging anyone by accident.
Watching for expiry
Manage > Certificates is sorted by expiry, which puts the certificate closest to lapsing first. That covers both kinds of record:
- Managed certificates renew themselves, so one approaching expiry means renewals are failing. Look at its jobs.
- External certificates cannot renew. They are listed precisely so their expiry dates are visible; acting on one means either renewing it the way it was originally issued, or creating a managed certificate for the same names to take it over.
The dashboard's landing page carries the same information as a chart, with counters for certificates expiring within 14 and 30 days.
Agent connection health
Manage > Agents shows when each agent last checked in and whether the control plane still considers it online. An agent that has gone quiet has not necessarily failed - it may simply be idle on its cadence - but one past its expected-poll deadline is worth looking at. The usual causes, in order of likelihood: the service is not running, the host cannot reach the control plane outbound over HTTPS, or the agent was revoked. See Troubleshooting.
MSP customer workspaces
Run aethercert as a managed service: isolated customer workspaces, slots and licence ownership, staff scoped per customer, shared customers, and white labeling.
Email notifications
Send an email through your own Microsoft 365 or SMTP infrastructure the moment a certificate is issued - mail apps, recipients, retries and history.