diff --git a/src/backups.js b/src/backups.js
index e00098404..368dba2e5 100644
--- a/src/backups.js
+++ b/src/backups.js
@@ -368,9 +368,13 @@ function backupApp(app, addonsToBackup, callback) {
 }
 
 // this function expects you to have a lock
-function backupBoxAndApps(callback) {
+function backupBoxAndApps(auditSource, callback) {
+    assert.strictEqual(typeof auditSource, 'object');
+
     callback = callback || NOOP_CALLBACK;
 
+    eventlog.add(eventlog.ACTION_BACKUP_START, auditSource, { });
+
     apps.getAll(function (error, allApps) {
         if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
 
@@ -403,28 +407,26 @@ function backupBoxAndApps(callback) {
             backupBoxWithAppBackupIds(backupIds, function (error, filename) {
                 progress.set(progress.BACKUP, 100, error ? error.message : '');
 
+                eventlog.add(eventlog.ACTION_BACKUP_FINISH, auditSource, { errorMessage: error ? error.message : null, filename: filename });
+
                 callback(error, filename);
             });
         });
     });
 }
 
-function backup(eventSource, callback) {
-    assert.strictEqual(typeof eventSource, 'object');
+function backup(auditSource, callback) {
+    assert.strictEqual(typeof auditSource, 'object');
     assert.strictEqual(typeof callback, 'function');
 
     var error = locker.lock(locker.OP_FULL_BACKUP);
     if (error) return callback(new BackupsError(BackupsError.BAD_STATE, error.message));
 
-    eventlog.add(eventlog.ACTION_BACKUP_START, eventSource, { });
-
     progress.set(progress.BACKUP, 0, 'Starting'); // ensure tools can 'wait' on progress
 
-    backupBoxAndApps(function (error, filename) { // start the backup operation in the background
+    backupBoxAndApps(auditSource, function (error) { // start the backup operation in the background
         if (error) console.error('backup failed.', error);
 
-        eventlog.add(eventlog.ACTION_BACKUP_FINISH, eventSource, { errorMessage: error ? error.message : null, filename: filename });
-
         locker.unlock(locker.OP_FULL_BACKUP);
     });
 
diff --git a/src/cloudron.js b/src/cloudron.js
index a76e70c6a..2e7c0e2a3 100644
--- a/src/cloudron.js
+++ b/src/cloudron.js
@@ -552,7 +552,7 @@ function doUpgrade(boxUpdateInfo, callback) {
 
     progress.set(progress.UPDATE, 5, 'Backing up for upgrade');
 
-    backups.backupBoxAndApps(function (error) {
+    backups.backupBoxAndApps({ userId: null, username: 'upgrader' }, function (error) {
         if (error) return upgradeError(error);
 
         superagent.post(config.apiServerOrigin() + '/api/v1/boxes/' + config.fqdn() + '/upgrade')
@@ -581,7 +581,7 @@ function doUpdate(boxUpdateInfo, callback) {
 
     progress.set(progress.UPDATE, 5, 'Backing up for update');
 
-    backups.backupBoxAndApps(function (error) {
+    backups.backupBoxAndApps({ userId: null, username: 'updater' }, function (error) {
         if (error) return updateError(error);
 
         // NOTE: the args here are tied to the installer revision, box code and appstore provisioning logic