Monitoring & the event log
Certificate automation only helps if you find out when it stops working. aethercert records what happened in three places, at three different levels of detail.
| Where | What it answers | |
|---|---|---|
| Event log | Monitor > Event Log | What happened in this organization, and who or what did it. |
| Job history | Manage > Jobs | What each individual issue, renew or revoke attempt did, and why it failed. |
| Agent logs | Files on the agent host | What the agent did locally - the reload command's output, the file it wrote. |
The event log
Every issuance, renewal, deployment and administrative action is appended to an organization-wide log with its outcome. It is append-only: there is no edit or delete, including for owners.
What is recorded
Each entry carries a timestamp, an actor (a user, an agent, or the system), an action, the object it affected, and a human-readable message.
| Area | Examples |
|---|---|
| Certificates | Created, updated, revoked, deleted; the external inventory being refreshed. |
| Jobs | Created and deleted, each tied to its certificate. |
| Agents | Enrolled, re-enrolled, updated, deleted. |
| Agent groups and policies | Created, updated, deleted; a policy being applied to a member. |
| Domains | Created, verified, DNS provider configured, deleted. |
| Authorities | Created, updated, deleted; a CA connector pairing. |
| Access | Sign-in and sign-out; a second-factor reset being requested and confirmed. |
| Organization | Members and invitations, SSO changes, customer workspaces being created. |
| Billing | Subscriptions synced or cancelled, a payment failing, MSP slots bought, assigned or released. |
Retention
The window is set by your plan, and it is enforced twice: the page will not show you anything older, and a nightly job physically deletes it.
| Plan | Event log retention |
|---|---|
| Free | 7 days |
| Standard | 30 days |
| Pro | 90 days |
| MSP | 90 days for the MSP's own workspace. Each customer workspace keeps the window of its own tier. |
Deletion is real. If you need a longer trail than your plan keeps, export what matters before it ages out - and see Plans and limits for what changes with an upgrade.
Job history
Manage > Jobs is the operational view: every issue, renew and revoke attempt, its state, and its error text if it failed.
| Action | When it is available |
|---|---|
| Retry | On a failed job. Requeues it with its attempt count reset. |
| Cancel | On a queued job that has not started. |
| Delete | Any job, to clear it out of the history. |
| Edit certificate | Opens the full edit dialog; saving reissues with the new configuration. |
Jobs retry automatically up to three times before they are marked failed, so a single transient DNS or network error resolves itself without anyone looking. A job that reaches failed has genuinely failed three times - see Troubleshooting.
Watching for expiry
View > Certificates is sorted by expiry, which makes the certificate closest to lapsing the first thing on the screen. That covers both kinds of record:
- Managed certificates renew themselves, so one approaching expiry means renewals are failing - look at its jobs.
- External certificates cannot renew. They are listed precisely so their expiry dates are visible somewhere; acting on one means either renewing it the way it was originally issued, or creating a managed certificate for the same names to take it over.
Agent connection health
View > Agents shows when each agent last checked in. An agent that has gone quiet has not necessarily failed - it may simply be idle on a 30-minute cadence - but one that has missed several intervals is worth looking at.
The usual causes, in order of likelihood: the service is not running, the host cannot reach the control plane outbound over HTTPS, or the agent was revoked. See Troubleshooting.
Logs on the agent host
Agents and CA connectors keep their own log files locally. That is where the detail lives which the event log deliberately does not carry - the exact output of a reload command, the path a file was written to, the raw error from a DNS provider's API.
| Linux | /etc/aethercert-agent/agent/ alongside the config, and the systemd journal for the unit. |
| Windows | %ProgramData%\aethercert\agent\. |
| Retention | 7 days on Free, fixed. Up to 30 days on Standard and MSP, up to 90 on Pro - configurable per agent, up to the plan's cap. |
Local retention is distinct from the dashboard's event log window. Changing your plan takes effect on the next check-in, including downward: an agent configured for 90 days on Pro is clamped to 30 immediately on a downgrade to Standard, without anyone editing it.