# Reading the activity trail | Raal Help Center > What the Activity tab records, how grouped changes work, and how to tell an automatic entry from one a person made. Source: https://raal.io/help/asset-management/reading-the-activity-trail --- Asset Management # Reading the activity trail What the Activity tab records, how grouped changes work, and how to tell an automatic entry from one a person made. 2 min read Updated 8 September 2026 The **Activity** tab on a device is an append only record of everything that has happened to it, newest first. Nothing on it can be edited or removed. ![The Activity tab on a device showing dated entries with who made each change](/help-images/709b6b82b85eba32.png) ## What gets recorded - The device being created, imported from a CSV, or updated by a later import. - Every individual field you change, for example "Status changed to In repair", "Condition set to Good", "Hostname updated", "Purchase cost set". - Holder changes: "Assigned to Jane Smith", "Holder unassigned", "Holder contact updated". - Audits: "Marked present (compliant)" and "Marked not found". - Photos and documents: "Photo / document added" and "Attachment removed", each naming the file. - Shipments: "Delivery shipment placed" and "Collection shipment placed", each linked to the order. - Security and compliance changes: "Disk encryption enabled", "Recovery key escrowed", "Screen lock enforced", "MDM compliance: Compliant". - End of life: "Disposed (Wiped)", "Data destruction certificate recorded", "Device returned". ## Several fields saved together become one entry If you open the wizard and change eight fields before clicking Save, you get one entry, not eight. It reads " made changes" with a badge counting the fields. Click it to expand the individual changes. ![The full activity trail on a device going back to the CSV import that created the record](/help-images/4bd85b01fd190455.png)![A grouped activity entry expanded to show each individual field that changed](/help-images/0d287215f82dc84e.png) ## Telling apart who did what Entries carry the person who made them, and there are four sources worth recognising: - **A person in the portal**: the normal case, with a name against the entry. - **A CSV import**: "Imported from CSV" or "Updated via import", attributed to whoever ran the import. - **A shipment**: grouped under "Shipment moved this device", attributed to whoever placed the order, and linking through to that order. - **The nightly MDM sync**: "Assignment date set from MDM", with no person against it, because no person was involved. Jamf and IRU report an enrolment date; Mosyle does not, so a Mosyle-only company keeps the date the delivery wrote. ## Entries tagged derived Two entries are marked **derived**: "Warranty expired" and "Warranty expiring soon", the latter appearing within 60 days of the end date. These are not events anyone caused. They are worked out from the warranty end date and shown on the timeline so the warranty story reads in order with everything else. ## Shipments dated where they happened If you add a device to the register months after it shipped, and its serial matches an order you already placed, that shipment appears on the trail dated at the order, not at the moment you added the device. The timeline stays a record of what happened to the machine rather than of when your paperwork caught up. An empty tab reads "No activity recorded yet." The trail loads twenty entries at a time. ## Related articles - [The asset detail page explained](/asset-management/the-asset-detail-page-explained) - [Orders and your asset register](/asset-management/orders-and-your-asset-register) - [Editing, cloning and checking in a device](/asset-management/editing-cloning-and-checking-in-a-device) On this page - [What gets recorded](#ox2l5ib4073) - [Several fields saved together become one entry](#tep1cmo2y7o) - [Telling apart who did what](#s06dfi52mqy) - [Entries tagged derived](#6att3dyr45r) - [Shipments dated where they happened](#f1lskss4rrk) - [Related articles](#xlmqp54ckq7)