Archive Manager for Exchange 8.9 - Auditing Guide

Configure auditing service

Finally you need to make sure that the Auditing service is correctly configured. As default it can be found under

<Common Files>\PAM\Services\PAMAuditing\PAMAuditingSv.exe.config

Ensure that the service is using secure channels:

<channels>

<channel ref="tcp" name="PamAuditing" port="7783" secure="true" />

</channels>

Start auditing service

Open Windows Services and start the Auditing service (MAM Auditing) if it is not already running. In case you have made changes to its configuration in the previous step, you must restart it.

Auditing in ArchiveWeb

The Auditing tab is accessible in ArchiveWeb if Auditing is configured properly. Auditing feature allows administrator (or other users defined in web config) to log defined user actions in the email archive, i.e. the administrator has an overview of archived / restored / retrieved emails and performed fulltext searches. Even all actions made in Enterprise Manager console (Exchange / Files) are logged.

To view the logs, from the main pane click Report, then Audit from the grey sub-bar. Then expand the Email Archive node to access the Archive Manager for Exchange logs or Archive Manager for Files node (or "Archive Manager Files Edition" node - both may be present in case older version has been upgraded) to access the Archive Manager for Files logs. Then you can browse through different types of logs – archive actions (Archive node), retrieve actions (Retrieve node) etc.

The log entries of the selected action are displayed in the main pane. Data of the log entry selected in the main pane are displayed below the list view (see the screenshot above).

List view functions are the same as in other ArchiveWeb lists:

·Change the column sorting order by selecting the given column header and clicking its down/up arrow on the right (in case the arrow is not visible adjust the width of the column by dragging the line)

·Group table data by any column. To do so, drag the column header to the bar right above the table. Generated groups can be expanded by clicking the arrows next to them. As usual, the sorting order can be changed by clicking the little arrow in the dragged column header.

·Create filters.

Any audit entry can be downloaded or tags can be added or removed from it. All tasks are available through the More actions menu. Click the More actions menu button located on the bottom right just below the list view. Then you can e.g:

·Add tags or Remove tags - these options allow you to add or remove tags from selected items

·Export results to ZIP - for search results only. This option will export search result items with summary to Excel file and allow to download the created ZIP to user's local machine.

·Export to XLS - this option will export the selected items to XLS file on the user's local machine and provide a download link to the same file.

·Download log entry: this option will download single log entry in log file format on user local machine.

When two or more items be checked, the More actions menu appears automatically under the list view (see the screenshot below).