Which logs verify when a device was upgraded?

ACLs are traffic-filtering rules applied to interfaces, not a logging mechanism for device events.

Email is a notification delivery method, not a log type that records device upgrade history.

SNMP is used for real-time monitoring and polling of device status, not for recording historical administrative actions like upgrades.

Audit logs capture a timestamped record of all administrative and configuration events on a device, including firmware or software upgrades. They are specifically designed to answer who did what and when, which is exactly what is needed to verify an upgrade event. No other log type provides this administrative accountability trail.