WSS Admin Guide

Monitoring Administrator Activities

The Audit Logs display all administrator activities within the selected timeframe.

Note: To view logs, you must have Audit Log permission for Manage Audit Logs.

Specifying criteria

You enter criteria to create a specific view of the audit log. The Audit Logs page includes a Search panel for this purpose.

To specify new criteria for the search and refresh the log:

• From the Home tab, select the Statistics tab, then select Activity Monitors.


The Activity Monitor pane displays.


• Select one or more dates from the last 90-day period; the current date is always the default:
  • Click to select a single date.
  • Shift-click or click and drag to select contiguous dates.
  • Ctrl-click to select non-contiguous dates.
• Select the checkbox for the data point for which to define criteria.
• Enter criteria for each selected column based on the following table.

Data Points and Criteria	Description
Admin	Filters data based on the administrator. Select the checkbox to select this data point. Select a criteria from the drop-down list. The criteria apply to alphanumeric searches Contains returns administrator email addresses containing the alphanumeric string in the text box. The string can be in the beginning, middle, or end of the entire value. Does not contain returns administrator email addresses whose values do not contain the alphanumeric string in the text box. The string can be in the beginning, middle, or end of the entire value. Equals returns records whose values exactly match the alphanumeric string in the text box. Does not equal returns records whose values are not exactly the alphanumeric string in the text box. In the text box, type the text string for the match criteria to use as a comparison. Type at least one character.
Time	Filters data based on the specified time.
Category	Category is the general area in which specific actions took place. Select the checkbox to select this data point. Select a category from the drop-down list. Account refers to actions done in the Accounts tab. Admin refers to actions done in the Admins tab. Group refers to actions done in the Groups tab. Policy refers to actions done in the Policies tab. Security refers to actions concerning logins and logouts. User refers to actions done in the Users tab. Saved Chart refers to actions in the Saved Charts page. Scheduled Report refers to actions in the Reports tab's Scheduled Reports page.
Action	Select an action type from the drop-down list. All refers to all actions on the list. Add refers to the creation of new items, such as adding users, groups, policies, and so on. The Details column displays some settings such as the proxy login, the user name, and status. Modify refers to changes made to existing items. Login refers to the logins performed by the administrator. The Details column displays the IP address. Logoff refers to the logouts performed by the administrator. The Details column displays the IP address. Switch back refers to the action performed by the service provider who has terminated access to the account. Switch to refers to action performed by the service provider. Generate Report refers to the reports that are processed and sent to recipients on a regular schedule. Import refers to the creation of users through LDAP or CSV imports. Delete stale user refers to a user deletion from the service after a period of time (stale days) if the user has been deleted from LDAP or CSV. Reset quota refers to administrators who reset users' quotas.

• Click Search.
  The log is refreshed with data based on your criteria. The log displays 10 records per page. To display the next set of records, click More.

Changing the number of returned records

The log displays 20 records at a time by default. You can change this number in the current view. The default number of records is restored after the user logs off and logs back in again.

To change the number of records per page:

• In Max Results, select the number of records to be displayed for the search.
• Click Search.
  The log is displayed in tabular format (columns and rows) if matching records are found.
• Use the More or Prev buttons to search the next or previous set of records based on the number in Max Results.

Interpreting Audit Log data

Log data appears in tabular format. The Filter box on the top right of the results panel is always active if records are displayed. The Filter box becomes inactive if no records are displayed, or if you change the Max Result to 200 and click Search.

The following table describes the data in the Audit Log.