What the Control Hub administrator activity log records

Verified 2026-09-05 · 11 claims · sources tier 2 · 1 disputed

Also known as administrator activity log, audit cluster.

Cisco states that the administrator activity log tracks site configuration changes and recording management actions, and never enumerates what a recording management action is 11. The activity log displays these site configuration changes and recording management activities only for a site that is Control Hub managed or linked 2.

Logged events and recording actions

The only recording action any source states is logged is manual deletion, which captures the actor, the time, the reason, and any notes 9. No source states that playing or downloading a recording is logged, and none states that any action is not logged 8.

Administrator roles and access

Cisco names organisation full administrators and read-only administrators as able to audit activities in the activity log, and names no permission 10. The Contact Center activity log article names no role, stating only that a Webex Contact Center administrator can audit activities, while the article that does name roles never mentions Contact Center in its body 1. Sources disagree on non-full administrator access: the Contact Center article announces that a new custom role will allow non-full administrators to access audit logs, using the future tense and without naming the role 3.

Retention, searching, and export limits

Webex migrated Contact Center audit logs from the Management Portal to Control Hub, backfilling 1 year of historical data, with older Management Portal data reachable until 31 March 2026 and unavailable from 1 April 2026 7.

Audit clusters outside India retain administrator activities for 1 year, while the audit cluster in India retains administrator activities for 3 years 5. Although the India audit cluster retains administrator activities for 3 years, the search interface only offers a date range of up to 1 year, with no documented route to reach the remaining 2 years of retained data 6.

Each activity log report exports at most 20,000 audit events, and an organisation with more must narrow the date range or the filters 4.

See also

See also Finding playing and deleting a Webex Contact Center recording.

Applicability

Across the claims in this article, the evidence covers Cisco Webex Contact Center and Cisco Webex, verified as of 2026-09-05. The deployment model is not covered by any claim in this article.

What remains uncertain

The specific custom role that gives non-full administrators audit log access is not covered by any claim in this article. The Control Hub audit-log permission that reads a deletion audit entry is not covered by any claim in this article. The Control Hub audit events reference that enumerates the categories is not covered by any claim in this article.

WarmTransfer. (2026, September 5). What the Control Hub administrator activity log records. WarmTransfer. https://warmtransfer.net/knowledge/wxcc-control-hub-audit-log

@misc{warmtransfer-wxcc-control-hub-audit-log,
  title  = {What the Control Hub administrator activity log records},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/wxcc-control-hub-audit-log},
  note   = {Verified 2026-09-05}
}