Audit Trail report

When the report completes it displays an activity list giving the:

  • Time – the time of an activity is logged in UTC but displayed in local time

  • Type and Subtype – activities specified in the Report Criteria section

  • Module Name – if the appliance is an Enterprise NetProfiler, then this column is displayed by default instead of the User Host Name column. The Module Name is the resolved name of the Enterprise NetProfiler module that logged the activity.

  • User – the user who originated the activity. This may be a human user or the system.

  • Successful – indicates if the activity was successful.

  • Event Count – how many identical events occurred within a 1-minute time frame. Rather than report each event individually, the report de-duplicates identical events that happened within the same time frame and tells you how many there were at that time.

  • Details – additional information about the activity

The following additional columns can be added to the report by choosing Add/Remove Columns... on the Activity List menu:

  • Module IP – if the appliance is an Enterprise NetProfiler, this is the IP address of the module on which the activity was logged.

  • Process ID – the ID of the process that originated the activity. This may be a user or the system.

  • Session ID – the ID of your browser session

  • User Host Name – the resolved host name of IP address from which the user listed in the activity caused the activity that was logged.

  • User IP – the IP address from which the user listed in the activity caused the activity to occur. This could be a user’s IP address or localhost for system user activities.

All columns except the Details column can be sorted in ascending or descending order.

Report controls

The report controls include:

Activity List section menu

The menu beside the title of the Activity List section of the report offers the following actions:

  • Add/Remove Columns – opens a column chooser tool that allows you to add more columns to the report where applicable. This can provide additional detail for some types of activities.

  • Change Number of Rows – controls how many activity entries are displayed on a page.

  • Show Filter – displays a filtering tool that allows you to limit the display to specific values appearing in each column.  more

  • Export to Host Group – uses the IP addresses in the User IP or Module IP column to create a host group. This allows you to track and alert on a group of IP addresses of interest.

  • Export to CVS – exports the contents of the report to a comma-separated-value file for use with other tools.

Templates menu

Use the Templates menu to perform any of the following:

  • Save As/Schedule – opens a page on which you can:

    • Save the current settings as a template for generating reports.

    • Schedule the appliance to generate reports (once or periodically) using these settings. The name of the report template is used with the date of the report as the report name.

    • Specify whether the generated reports should be saved until you delete them or until the storage space is needed for new reports. (When the storage capacity is exhausted, the appliance overwrites the oldest reports with new reports unless you indicate that they should be saved until you delete them.) Saved reports are accessible on the Reports > Saved Reports page.

    • Specify who the scheduled reports should be emailed to, and in which format.

    • Specify an email message to be included when reports are distributed.

If an outgoing mail server has been configured on the Configuration > General Settings page, the Save as/Schedule page includes a field for entering email addresses to which the report will be sent. The number of rows included in an email report is set on the Configuration > UI Preferences page.

  • Save as Default – saves the current Report Criteria settings and any modifications that have been made to a report that is currently being displayed.

  • Load Default Template – loads the default report criteria. If you have modified the criteria you can return to what you have previously saved as the default criteria.

Page display control icon

A small page icon at the upper-right corner of the report results section allows you to run additional reports without closing the first one. Click this icon to transfer the report in a new window.

Report Options menu

Use the Report Options menu to perform any of the following:

  • Save as – saves the report on the Reports > Saved Reports page.

  • Schedule – opens a page on which you can schedule the running of the report and specify the email distribution list and file format, as described under Templates menu above.

  • Print – prints the report using your machine's printing facilities.

  • Email – emails the report to one or more email addresses. The report is mailed in HTML format or attached to the email as a PDF or CSV file. If you select the PDF or CSV option, you can specify the name of the attached file. The name can include characters that will be replaced by the date and time that the email was sent, as follows:

%d is replaced by the date in MMDDYY format. For example, 021509.

%t is replaced by the time in HHMM format. For example, 1536.

This option requires a mail server to have been identified in the Outgoing Mail Server (SMTP) Settings section of the Configuration > General Settings page.

  • Export – exports report as CSV (comma-separated values) file, HTML archive file or PDF file.

Report Criteria section

Activity types and subtypes

Audit trail