# Track tag change origin

**URL:** <https://forum.inductiveautomation.com/t/track-tag-change-origin/103542>\
**Category:** Ignition\
**Created:** [March 11, 2025, 7:55pm UTC](https://forum.inductiveautomation.com/t/track-tag-change-origin/103542 "2025-03-11T19:55:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jakned](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jakned](https://forum.inductiveautomation.com/u/jakned)\
**Post date:** [March 11, 2025, 7:55pm UTC](https://forum.inductiveautomation.com/t/track-tag-change-origin/103542/1 "2025-03-11T19:55:24Z")

</div>

Hi, i have a opc tag that we use for interacting with a plc. The tag is there to stop the machine from operating until the tag is set to false. I have a script that users use to set the tag to true or false depending on some circumstances.

Now i noticed the tag sometimes changes to false with no apparent reason. User does not run the script so i am wondering what did it.

Is there a way to check what caused the tag to change?

Thanks!

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [March 11, 2025, 7:59pm UTC](https://forum.inductiveautomation.com/t/track-tag-change-origin/103542/2 "2025-03-11T19:59:17Z")

</div>

Turn on and configure the audit subsystem.

> **[Audit Log and Profiles | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/platform/audit-log-and-profiles)**
>
> Ignition's built-in auditing system automatically records certain actions that occur in the system, such as a Tag writes or User Source authentication, into a SQL database table. Utilizing the system involves creating an Audit Profile, followed by...

---

<div class="post-metadata">

**Author:** ![jakned](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jakned](https://forum.inductiveautomation.com/u/jakned)\
**Post date:** [March 12, 2025, 9:22am UTC](https://forum.inductiveautomation.com/t/track-tag-change-origin/103542/3 "2025-03-12T09:22:11Z")

</div>

Hi Phil, thanks! I managed to track down tag writes i was looking for in the audit table. I cant actually tell what is doing that tag write.

Actor and Actor host are unknown, originating system is "project: MyProject".

We write to the tag from gateway events and few buttons in application. I can see that there are events that do have the actor and actor host, those are the ones that user does.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [March 12, 2025, 11:30am UTC](https://forum.inductiveautomation.com/t/track-tag-change-origin/103542/4 "2025-03-12T11:30:37Z")

</div>

> [@jakned](#):
>
> Actor and Actor host are unknown

Right, gateway events are considered privileged, and aren't associated with a user.

Auditing is not really suited to **troubleshooting** your gateway events. You'll have to study your code paths yourself.