diff --git a/src/backups.js b/src/backups.js
index 2f81e0ed0..de4de7937 100644
--- a/src/backups.js
+++ b/src/backups.js
@@ -845,8 +845,9 @@ function cleanupAppBackups(backupConfig, referencedAppBackups, callback) {
     });
 }
 
-function cleanupBoxBackups(backupConfig, callback) {
+function cleanupBoxBackups(backupConfig, auditSource, callback) {
     assert.strictEqual(typeof backupConfig, 'object');
+    assert.strictEqual(typeof auditSource, 'object');
     assert.strictEqual(typeof callback, 'function');
 
     const now = new Date();
@@ -893,6 +894,8 @@ function cleanupBoxBackups(backupConfig, callback) {
                 api(backupConfig.provider).remove(backupConfig, path.dirname(filePaths[0]), function (error) {
                     if (error) debug('cleanupBoxBackups: unable to prune directory %s : %s', path.dirname(filePaths[0]), error.message);
 
+                    eventlog.add(eventlog.ACTION_BACKUP_CLEANUP, auditSource, { backup: backup });
+
                     backupdb.del(backup.id, function (error) {
                         if (error) debug('cleanupBoxBackups: error removing from database', error);
                         else debug('cleanupBoxBackups: removed %j', filePaths);
@@ -951,7 +954,8 @@ function cleanupSnapshots(backupConfig, callback) {
     });
 }
 
-function cleanup(callback) {
+function cleanup(auditSource, callback) {
+    assert.strictEqual(typeof auditSource, 'object');
     assert(!callback || typeof callback === 'function'); // callback is null when called from cronjob
 
     callback = callback || NOOP_CALLBACK;
@@ -964,7 +968,7 @@ function cleanup(callback) {
             return callback();
         }
 
-        cleanupBoxBackups(backupConfig, function (error, referencedAppBackups) {
+        cleanupBoxBackups(backupConfig, auditSource, function (error, referencedAppBackups) {
             if (error) return callback(error);
 
             cleanupAppBackups(backupConfig, referencedAppBackups, function (error) {
diff --git a/src/cron.js b/src/cron.js
index 72f534d8b..c27df4bd3 100644
--- a/src/cron.js
+++ b/src/cron.js
@@ -139,7 +139,7 @@ function recreateJobs(tz) {
     if (gCleanupBackupsJob) gCleanupBackupsJob.stop();
     gCleanupBackupsJob = new CronJob({
         cronTime: '00 45 */6 * * *', // every 6 hours. try not to overlap with ensureBackup job
-        onTick: backups.cleanup,
+        onTick: backups.cleanup.bind(null, AUDIT_SOURCE, NOOP_CALLBACK),
         start: true,
         timeZone: tz
     });
diff --git a/src/eventlog.js b/src/eventlog.js
index 2ca073b2a..6fef19c8d 100644
--- a/src/eventlog.js
+++ b/src/eventlog.js
@@ -20,6 +20,7 @@ exports = module.exports = {
     ACTION_APP_LOGIN: 'app.login',
     ACTION_BACKUP_FINISH: 'backup.finish',
     ACTION_BACKUP_START: 'backup.start',
+    ACTION_BACKUP_CLEANUP: 'backup.cleanup',
     ACTION_CERTIFICATE_RENEWAL: 'certificate.renew',
     ACTION_CLI_MODE: 'settings.climode',
     ACTION_START: 'cloudron.start',
diff --git a/webadmin/src/js/index.js b/webadmin/src/js/index.js
index cd473027a..6e9d7f5b3 100644
--- a/webadmin/src/js/index.js
+++ b/webadmin/src/js/index.js
@@ -295,10 +295,10 @@ var ACTION_APP_INSTALL = 'app.install';
 var ACTION_APP_RESTORE = 'app.restore';
 var ACTION_APP_UNINSTALL = 'app.uninstall';
 var ACTION_APP_UPDATE = 'app.update';
-var ACTION_APP_UPDATE = 'app.update';
 var ACTION_APP_LOGIN = 'app.login';
 var ACTION_BACKUP_FINISH = 'backup.finish';
 var ACTION_BACKUP_START = 'backup.start';
+var ACTION_BACKUP_CLEANUP = 'backup.cleanup';
 var ACTION_CERTIFICATE_RENEWAL = 'certificate.renew';
 var ACTION_CLI_MODE = 'settings.climode';
 var ACTION_START = 'cloudron.start';
@@ -325,6 +325,7 @@ app.filter('eventLogDetails', function() {
         case ACTION_APP_LOGIN: return 'App ' + data.appId + ' logged in';
         case ACTION_BACKUP_START: return 'Backup started';
         case ACTION_BACKUP_FINISH: return 'Backup finished. ' + (errorMessage ? ('error: ' + errorMessage) : ('id: ' + data.filename));
+        case ACTION_BACKUP_CLEANUP: return 'Backup ' + data.backup.id + ' removed';
         case ACTION_CERTIFICATE_RENEWAL: return 'Certificate renewal for ' + data.domain + (errorMessage ? ' failed' : 'succeeded');
         case ACTION_CLI_MODE: return 'CLI mode was ' + (data.enabled ? 'enabled' : 'disabled');
         case ACTION_START: return 'Cloudron started with version ' + data.version;
diff --git a/webadmin/src/views/activity.html b/webadmin/src/views/activity.html
index 3492b522d..f5dcbb65a 100644
--- a/webadmin/src/views/activity.html
+++ b/webadmin/src/views/activity.html
@@ -10,7 +10,7 @@
     <div class="filter">
       <input type="text" class="form-control" ng-model="search" ng-model-options="{ debounce: 1000 }" ng-change="updateFilter()" placeholder="Search"/>
       <select class="form-control" ng-model="action" ng-options="a.name for a in actions" ng-change="updateFilter()">
-        <option value="">-- all actions --</option>
+        <option value="">-- All actions --</option>
       </select>
       <select class="form-control" ng-model="pageItems" ng-options="a.name for a in pageItemCount" ng-change="updateFilter(true)">
       </select>
diff --git a/webadmin/src/views/activity.js b/webadmin/src/views/activity.js
index 6d1881dc4..5da48a943 100644
--- a/webadmin/src/views/activity.js
+++ b/webadmin/src/views/activity.js
@@ -15,6 +15,7 @@ angular.module('Application').controller('ActivityController', ['$scope', '$loca
         { name: 'app.uninstall', value: 'app.uninstall' },
         { name: 'app.update', value: 'app.update' },
         { name: 'app.login', value: 'app.login' },
+        { name: 'backup.cleanup', value: 'backup.cleanup' },
         { name: 'backup.finish', value: 'backup.finish' },
         { name: 'backup.start', value: 'backup.start' },
         { name: 'certificate.renew', value: 'certificate.renew' },