---
title: Records and logs
description: The data and accountability surfaces of the ARGUS Operations Console - enrichment export datasets, the operator audit log, and the incident-webhook dead-letter queue.
---

# Records and logs



Three surfaces in the Operations Console deal with data at rest rather than live infrastructure. Each has a console page and an argusctl equivalent.

## Records: enrichment export datasets

The RECORDS page is the data exploration slice: it browses the enrichment records produced by the detection pipeline, organized by tenant, store, and month, with record counts, total bytes, and dataset coverage per slice. Use it to pull a CSV for a tenant's quarter, tag a slice for fine-tuning, or verify retention is moving cold data correctly.

* Guide: [Browse and download enrichment datasets](/docs/records/download-records)
* CLI: `argusctl records ls` ([reference](/docs/cli/records))

## Logs: the operator audit log

Every authenticated call to the ops API, whether it came from the console or from argusctl, writes one audit row attributed to the PAT owner's Clerk user. There is no anonymous use. The audit log page lets you filter by actor, route, status, and time, and answers "who did what, when, from where."

* Guide: [Read the operator audit log](/docs/records/logs-audit)
* CLI: `argusctl logs tail` ([reference](/docs/cli/logs))

## DLQ: the incident-webhook dead-letter queue

When an incident webhook fails delivery to the platform's webhook receiver, the event lands in the dead-letter queue instead of disappearing. The DLQ page makes broken integration loud and actionable: each row shows the error class, retry count, last error message, and payload digest, and a failed row can be re-armed for redelivery.

* Guide: [Work the dead-letter queue](/docs/records/dlq)
* CLI: `argusctl dlq ls` / `argusctl dlq retry` ([reference](/docs/cli/dlq))

## Shared behavior

All three surfaces are reads (DLQ retry is the one write, and it is audited like every other write). Console pages follow the standard refresh model: polled pages update values in place on a 15 second timer with no loading flash, and actions toast and update in place.


---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)