Start auditing service
Open Windows Services and start the Auditing service (MAM Auditing) if it is not already running. In case you have made changes to its configuration in the previous step, you must restart it.
Auditing in ArchiveWeb
The Auditing tab is accessible in ArchiveWeb if Auditing is configured properly. Auditing feature allows administrator (or other users defined in web config) to log defined user actions in the email archive, i.e. the administrator has an overview of archived / restored / retrieved emails and performed fulltext searches. Even all actions made in Enterprise Manager console (Exchange / Files) are logged.
To view the logs, from the main pane click Report, then Audit from the grey sub-bar. Then expand the Email Archive node to access the Archive Manager for Exchange logs or Archive Manager for Files node (or "Archive Manager Files Edition" node - both may be present in case older version has been upgraded) to access the Archive Manager for Files logs. Then you can browse through different types of logs archive actions (Archive node), retrieve actions (Retrieve node) etc.
|
|
NOTE: Not all Auditing tab functions may be available for the logged-on user. The functions must be allowed for the user under <LoggedOnUser>/ Manage Settings/ Roles and Permissions sections. For instance, user sees by default only its own search result logs displayed under Email Archive/ Search. Auditors must have Access all mailboxes permission to view search logs of other users (under <LoggedOnUser>/ Manage Settings/ Roles). |
|
|
NOTE: [OFFLINE] text next to the file server in the left tree-view indicates that the given server has been decommissioned in your environment and is accessible only via ArchiveWeb. This access must be configured under Manage settings/Profile/File Archive Servers section. |
The log entries of the selected action are displayed in the main pane. Data of the log entry selected in the main pane are displayed below the list view (see the screenshot above).
List view functions are the same as in other ArchiveWeb lists:
·Change the column sorting order by selecting the given column header and clicking its down/up arrow on the right (in case the arrow is not visible adjust the width of the column by dragging the line)
·Group table data by any column. To do so, drag the column header to the bar right above the table. Generated groups can be expanded by clicking the arrows next to them. As usual, the sorting order can be changed by clicking the little arrow in the dragged column header.
·Create filters.
Any audit entry can be downloaded or tags can be added or removed from it. All tasks are available through the More actions menu. Click the More actions menu button located on the bottom right just below the list view. Then you can e.g:
·Add tags or Remove tags - these options allow you to add or remove tags from selected items
·Export results to ZIP - for search results only. This option will export search result items with summary to Excel file and allow to download the created ZIP to user's local machine.
|
|
NOTE: This function is only available if the user has Export results to ZIP role allowed for Audit (under <LoggedOnUser>/ Manage Settings/ |
·Export to XLS - this option will export the selected items to XLS file on the user's local machine and provide a download link to the same file.
|
|
NOTE: When downloading large amount of items it is reasonable to split the data in more XLS files. To do this value for the key "ItemsPerXLS" needs to be changed in ArchiveWeb's web.config file. The default value is "500000" and represents number of rows for single XLS file during the export. In order to set correct value for the key please refer to Excel limits on the page https://support.office.com/en-us/article/excel-specifications-and-limits-1672b34d-7043-467e-8e27-269d656771c3. |
·Download log entry: this option will download single log entry in log file format on user local machine.
When two or more items be checked, the More actions menu appears automatically under the list view (see the screenshot below).
