Guides
Getting StartedWorking with FilesFile PreviewsDeployment TopologiesVersion ControlBranches & MergingRunner (Headless CI)Sharing & CollaborationRFIs & SubmittalsNotifications & InboxSearchTrash, History & RollbackMigrating Existing Data
Admin & IT
Organizations, Projects & MembersIdentityPermissionsSelf-Hosted Seed NodesSecuritySecurity Architecture (Whitepaper)End-to-End Encryption SetupBilling & PlansOperationsDeploying to Your TeamData Portability & Offboarding
Reference
Filesystem Compatibility & ConformanceEngine Config File (config.json)Network Requirements
CLI Reference
swarmfileswarmfile-doctorswarmfile-migrateswarmfile-searchswarmfile-seedswarmfile-brlock
Browse docs
Guides
Getting StartedWorking with FilesFile PreviewsDeployment TopologiesVersion ControlBranches & MergingRunner (Headless CI)Sharing & CollaborationRFIs & SubmittalsNotifications & InboxSearchTrash, History & RollbackMigrating Existing Data
Admin & IT
Organizations, Projects & MembersIdentityPermissionsSelf-Hosted Seed NodesSecuritySecurity Architecture (Whitepaper)End-to-End Encryption SetupBilling & PlansOperationsDeploying to Your TeamData Portability & Offboarding
Reference
Filesystem Compatibility & ConformanceEngine Config File (config.json)Network Requirements
CLI Reference
swarmfileswarmfile-doctorswarmfile-migrateswarmfile-searchswarmfile-seedswarmfile-brlock
Docs / Admin & IT / Operations

Operations

This page covers the tools you'll reach for as the person operating an org day to day: the audit log, retention policy, and connectivity diagnostics.

Audit log#

The Activity tab in the web dashboard is a unified activity feed, open to any org member, covering:

  • ACL changes
  • History events
  • Quarantine incidents
  • Org-level audit events
  • Notifications
  • Unlock requests

The feed is ACL-filtered server-side: owners see everything, members see events on entries they can read, and quarantine incidents and org-policy events project to empty for non-owners. Everything lands in one feed instead of being scattered across separate logs. It's live-updating over SSE, so you see events as they happen rather than on a refresh. You can export it to CSV, capped at 100k rows per export - the export endpoint is owner-only.

What's not built yet: forwarding these event streams to an external SIEM (Splunk, Datadog, S3). Today the underlying events are stored internally only, with CSV as the only export path. See Security for the full list of what's still on the roadmap.

Retention & garbage collection#

Trash and soft-delete retention is per-user and configurable by the org, from 1 to 3650 days. The end-user side of this - restoring a deleted file, browsing history, rolling back a change - is covered in Trash, History & Rollback; this page is about the org-level policy knob that governs how long deleted data is kept before garbage collection reclaims it. Set the retention window based on your org's compliance and recovery needs - a longer window costs more storage but gives you (and your users) a longer recovery runway.

Connectivity diagnostics#

Swarmfile ships two ways to run the same connectivity probe suite:

  • swarmfile doctor, proxied through a running engine.
  • swarmfile-doctor, a standalone binary that doesn't need a running engine at all - useful for a machine that isn't mounting anything yet, or for isolating whether a problem is the engine or the network.

Both run the same checks: DNS, hub reachability, cloud storage, the peer-to-peer layer, mDNS discovery, and OIDC/auth. Output is colorized pass/warn/fail for a human to read, or --json for attaching straight to a support ticket.

Diagnostics also run automatically in the background on a periodic basis, not just when you invoke them by hand, and there's a hub-side deep-health endpoint that probes round-trip from the server side - so a problem can surface from either direction. Always-public liveness endpoints exist separately, for basic uptime monitoring.

One probe worth knowing about specifically: the plan probe. If a self-hosted seed or NAS node is running under a plan that doesn't include the seed-node entitlement, this probe fails clearly and explicitly, instead of the node just silently misbehaving or repeating the same log line forever. If you're setting up a seed node, see Self-Hosted Seed Nodes for the plan requirement.

Reach for swarmfile doctor any time something feels wrong and you're not sure whether it's your network, your account, or the service - it's the fastest way to narrow that down, and its output is what support will ask for first. Full flag reference is at swarmfile-doctor.