How to create an Auditing Report for more than 3 months (4275201)

How to create an Auditing Report for more than 3 months

Foglight generates security and change logs that contain information about the users who are authenticated upon logging in to Foglight, and user management or configuration changes, such as changes to Foglight registry and rules. You can use the View Audit Information dashboard to look at individual log entries. Each entry shows the date and time at which the operation is performed, name of the user who initiated the operation, name of the service that performed the operation, and the operation name.

By default Foglight shows in the Web Console information for only 1 day. Sometimes a report might be needed for a longer time range.

RESOLUTION 1

From the Foglight  Web Console:

• Administration | Setup & Support | View Audit Information 
• In the upper right side; there is a scroll down option
• Clicking on that scroll down section you have:
• Last 1h 4h 8h 24h 48h 72h 7d all More
• Click "More" scroll down; it will display:
• Today |Yesterday |This week |Last Week |This month |Last Month |This year |Last year
• Choose desired Time Range and the information will be displayed.

Once the information is displayed click in the Properties icon right to the search field and click export. Information can be exported as Excel, PDF, XML & CSV.

RESOLUTION 2

The auditing information is stored in a Foglight database table called auditing_log.

Example query: SELECT  *  FROM auditing_log
 

RESOLUTION 3

From the Foglight Management Server (FMS) support bundle:

• Extract the Zip file.
• Access file AuditingLog_YYYY-MM-DD_hhmmss.xml
• The file will include audit entries for the last 7 days.