Finally you need to make sure that the Auditing service is correctly configured. As default it can be found under
Ensure that the service is using secure channels:
<channel ref="tcp" name="PamAuditing" port="7783" secure="true" />
Open Services and start the Auditing service (MAM Auditing) if it is not running. In case you have made changes to its configuration in the previous step, you will have to restart it.
In the case of Archive Manager for Exchange: Ensure that the ExchangePamWS has anonymous access turned off and Windows integrated authentication turned on on the Archive Manager Server. To do so:
1.Open Start / All programs / Administrative tools / IIS Manager
2.In the IIS Manager expand the tree down to <ComputerName> \ Web Sites \ Default Web Site. Right-click the ExchangePamWS and from the context menu choose Properties.
For IIS 8
Locate the ExchangePamWS and in the main pain double-click Authentication. Then right-click Anonymous Authentication in the main pane and select Disable. For Windows Authentication select Enable. IIS 8 configuration is then finished.
3.In the Directory Security tab, Authentication and access control click Edit. In the pop-up window make sure that the Integrated Windows authentication is checked and Enable anonymous access is NOT checked.
The Auditing tab is accessible in ArchiveWeb if Auditing is configured properly. Auditing feature allows administrator (or other users defined in web config) to log defined user actions in the email archive, i.e. the administrator has an overview of archived / restored / retrieved emails and performed fulltext searches. Even all actions made in Enterprise Manager console (Exchange / Files) are logged.
To view the logs, from the main pane click Report, then Audit from the grey sub-bar. Then unfold the Email Archive node to access the Archive Manager for Exchange logs or Archive Manager for Files node (or "Archive Manager Files Edition" node - both may be present in case older version has been upgraded) to access the Archive Manager for Files logs. Then you can browse through different types of logs archive actions (Archive node), retrieve actions (Retrieve node) etc.
NOTE: Not all Auditing tab functions may be available for the logged-on user. The functions must be allowed for the user under <LoggedOnUser>/ Manage Settings/ Roles and Permissions sections. For instance, user sees by default only its own search result logs displayed under Email Archive/ Search. To make all users search logs available for the user, s/he must have Access all mailboxes permission allowed for Auditing (under <LoggedOnUser>/ Manage Settings/ Roles).
NOTE: [OFFLINE] text next to the file server in the left tree-view indicates that the given server has been decommissioned in your environment and is accessible only via ArchiveWeb. This access must be configured under Manage settings/Profile/File Archive Servers section.
The log entries of the selected action are displayed in the main pane. Data of the log entry selected in the main pane are displayed below the list view (see the screenshot above).
List view functions are the same as in other ArchiveWeb lists:
ØChange the column sorting order by selecting the given column header and clicking its down/up arrow on the right (in case the arrow is not visible adjust the width of the column by dragging the line)
ØGroup table data by any column. To do so, drag the column header to the bar right above the table. Generated groups can be expanded by clicking the arrows next to them. As usual, the sorting order can be changed by clicking the little arrow in the dragged column header.
ØCreate filters (as described in Filter Builder section of ArchiveWeb manual).
Any audit entry can be downloaded or tags can be added or removed from it. All tasks are available through the More actions menu. Click the More actions menu button located on the bottom right just below the list view. Then you can e.g:
·Add tags or Remove tags : these options allow you to add or remove tags from selected items (for more information on tags see the Tagged items tab section)
·Export results to ZIP (only for ArchiveWeb/Archive Manager for Exchange/Search or ArchiveWeb/Archive Manager for Files/Search entries); this option will export search result items with summary to Excel file and allow to download the created ZIP to user's local machine.
NOTE: This function is only available if the user has Export results to ZIP role allowed for Audit (under <LoggedOnUser>/ Manage Settings/ Roles).
·Export to XLS: this option will export the selected items to XLS file on the user's local machine and provide a download link to the same file.
NOTE: When downloading large amount of items it is reasonable to split the data in more XLS files. To do this value for the key "ItemsPerXLS" needs to be changed in ArchiveWeb's web.config file. The default value is "500000" and represents number of rows for single XLS file during the export. In order to set correct value for the key please refer to Excel limits on the page https://support.office.com/en-us/article/excel-specifications-and-limits-1672b34d-7043-467e-8e27-269d656771c3.
·Download log entry: this option will download single log entry in log file format on user local machine.
When two or more items be checked, the More actions menu appears automatically under the list view (see the screenshot below).