Record customer configuration changes, administrator actions with target and reason, and when operational alerts fire and recover. It is an operating record, not screen or keystroke monitoring.