Viewing information about an audit event

This functionality is available with the View audit events permission.

To view information about an audit event:

1. In the main window of the application web interface, open the management console tree and select the Events section.
2. Select the Audit tab.

   Application event information is displayed as a table.

3. Select the event for which you want to view information.

   This opens a window containing information about the event.

The audit event information window includes the following tabs:

• Summary.

  This tab displays general information about the event and the modified object.

• Modified parameters.

  This tab displays detailed information about the modified settings of the object involved in the event. This tab is displayed if recording of modified settings is enabled in the Audit Log settings and if the event type is Rules, Dictionaries, or Settings.

Summary

This tab displays the following data:

• GUID is the unique global ID of the event.
• Total event parts is the total number of parts with information about the event.
• Event part is the number of the part with information about the event.
• Date and time is the date and time when the event occurred. The time zone is the time zone of the node on which the event occurred.
• Node is the IP address and port of the node that processed the event.
• User IP address is the IP address of the computer from which the event was initiated.
• User login is the login of the user that initiated the event.
• User role are the roles of the user that initiated the event.
• Account type is the account type of the KSMG user that initiated the event.
• Result is the result of the event.

Under Modified object details, the following information is displayed:

• Event type is the type of the event.
• Event is the event that occurred.

  For events of the Dictionaries type:

  • Dictionary name is the name of the dictionary in which the event occurred.
  • Dictionary ID is the ID of the dictionary in which the event occurred.

  For events of the Rules type:

  • Rule name is the name of the rule in which the event occurred.
  • Rule ID is the ID of the rule in which the event occurred.

  For events of the Backup type:

  • Application message ID is the App ID value of the message involved in the the event.
  • Backup node is the IP address and port of the node in whose Backup the event occurred.
  • SMTP Message-ID is the SMTP Message-ID value of the message involved in the the event. If it cannot be determined, a dash is displayed.

  For events of the Authentication type:

  • Authentication type is the authentication type that was used when the event occurred.
  • Fail details is the the reason why the authentication was unsuccessful. This field is displayed if the event result is Failure.

Modified parameters

This tab displays detailed information about modified settings for Rules, Dictionaries, and Settings event types with the Success result. Modifications involving configuration of notification templates and applying notification templates in rules are not logged.

Event list items look like this:

• If the modified setting contains one value:
  • Rule or dictionary created: <SettingCode>[][<NewValue>]. All settings of a newly created entity are considered modified.
  • Rule, dictionary, or a setting from the Protection section modified: <SettingCode>[<OldValue>][<NewValue>]. Settings of an entity are considered modified if their values changed.
  • Rule or dictionary deleted: <SettingCode>[<OldValue>][]. All settings of a deleted created entity are considered modified.
• If the modified setting contains a list of values:
  • Rule or dictionary created: <SettingCode>.Added[<Value_1> <Value_2> <Value_N>]. All settings of a newly created entity are considered modified.
  • Rule or dictionary modified and values added to the list: <SettingCode>.Added[<Value_1> <Value_2> <Value_N>].
  • Rule or dictionary modified and values removed from the list: <SettingCode>.Removed[<Value_1> <Value_2> <Value_N>].
  • Rule or dictionary modified, values added from the list and removed from it:

    <SettingCode>.Added[<Value_1> <Value_2> <Value_N>]

    <SettingCode>.Removed[<Value_1> <Value_2> <Value_N>]

    If preexisting values in a list were modified, the modified list values are considered removed and are listed under Removed[], and the list values assigned as the result of the modification are listed under Added[].

  • Rule or dictionary deleted: <SettingCode>.Removed[<Value_1> <Value_2> <Value_N>].

If the lists before and after the modification differ only in the order of the items, the setting is considered unchanged and no record is displayed for that setting.

For setting codes, see the appendices.

Example: In a rule, the following addresses were present in the sender list: aaa@test.com bbb@test.com ccc@test.com. The administrator modified the list values as follows and saved the changes: aaa@test.com → abb@test.com bbb@test.com → bcc@test.com In the Audit Log, on the Modified parameters tab, the following lines are displayed: <SettingCodeSender>.Added[abb@test.com bcc@test.com] <SettingCodeSender>.Removed[aaa@test.com bbb@test.com]

Inside square brackets, the following characters are escaped:

, ; [ ] * % { } ' " = \ newline

Example: The rule name was Old rule [1], the administrator changed it to New rule. In the Audit Log, on the Modified parameters tab, the following line is displayed: <SettingCodeName>[Old rule %5B1%5D][New rule]

Page top