Exploring Audit Data

Required Role: Auditing Viewer (or Full Administrator)

Continue reading:

Viewing Audit Events

  1. Click the Audits tab. By default, the Audit Events report opens, listing all events that occurred within the last hour, with the most recent at the top:

The Audit Events and Recent Denied Accesses reports are available by default. You create your own reports and apply a variety of filters as detailed in the next section.

Filtering Audit Events

You filter audit events by specifying a time range or adding one or more filters containing an audit event field, operator, and value.

Specifying a Time Range

  1. Click the date-time range at the top right of the Audits tab.
  2. Do one of the following:
    • Click a Last n hours link.
    • Specify a custom range:
      1. Click Custom range.
      2. In the Selected Range endpoints, click each endpoint and specify a date and time in the date control fields.
  3. Click Apply.

Adding a Filter

  1. Do one of the following:
    • Click the icon that displays next to a field when you hover in one of the event entries.
    • Click the Filters link. The Filters pane displays.
      1. Click Add New Filter to add a filter.
      2. Choose a field in the Select Property... drop-down list. You can search by fields such as username, service name, or operation. The fields vary depending on the service or role. The service name of the Navigator Metadata Server is Navigator.
      3. Choose an operator in the operator drop-down list.
      4. Type a field value in the value text field. To match a substring, use the like operator. For example, to see all the audit events for files created in the folder /user/joe/out, specify Source like /user/joe/out.
    A filter control with field, operation, and value fields is added to the list of filters.
  2. Click Apply. A field, operation, and value breadcrumb is added above the list of audit events and the list of events displays all events that match the filter criteria.

Removing a Filter

  1. Do one of the following:
    • Click the x next to the filter above the list of events. The list of events displays all events that match the filter criteria.
    • Click the Filters link.
      1. Click the at the right of the filter.
      2. Click Apply. The filter is removed from above the list of audit event and the list of events displays all events that match the filter criteria.