Users Guide

Monitor audit logs
OpenManage Enterprise > Monitor > Audit logs page lists the log data to help you or the Dell EMC Support teams in
troubleshooting and analysis. An audit log is recorded when:
● A group is assigned or access permission is changed.
●
User role is modified.
● Actions that were performed on the devices monitored by OpenManage Enterprise.
The audit log files can be exported to the CSV file format. See Export all or selected data on page 63.
NOTE:
● To perform any tasks on OpenManage Enterprise, you must have necessary user privileges. See Role and scope-based
access control in OpenManage Enterprise on page 15.
● Scope-based restrictions are not applicable to the Audit logs.
1. To view the audit logs, select Monitor > Audit Logs.
The audit logs that OpenManage Enterprise stores and displays about the tasks performed by using the appliance are
displayed. For example, user login attempts, creation of alert policies, and running different jobs.
2. To sort data in any of the columns, click the column title.
3. To quickly search for information about an audit log, click Advanced Filters.
The following fields are displayed that act as filters to quickly search for data.
4. Enter or select data in the following fields:
● Severity: Select the severity level of a log data. The available options are info, warning, and critical.
○ Critical: Any unusual action happened. Immediate attention is needed.
○ Warning: The event is significant, but does not need immediate attention.
○ Info: Any action performed with success.
● Start Time and End Time: To view audit logs of a specified period.
● User: To view audit logs from a specific user. For example, admin, system, device manager, and viewer.
● Source Address: To view audit logs from a specific system. For example, the system where you have logged in to the
OpenManage Enterprise.
● Category: To view audit logs of audit or configuration type.
○ Audit: Generated when a user logs in or out of the OpenManage Enterprise appliance.
○ Configuration: Generated when any action is performed on a target device.
● Description Contains: Enter the text or phrase contained in the log data that you are searching for. All logs with the
selected text are displayed. For example, if you enter warningSizeLimit, all the logs with this text are displayed.
● Message ID: Enter the message ID. If the search criteria matches, only the items with the matching message ID are
displayed.
5. To remove the filter, click Clear All Filters.
6. To export an audit log or all the audit logs, select Export > Export Selected, or Export > Export All Audit Logs
respectively. For more information about exporting the audit logs, see Export all or selected data on page 63.
7. To get all the latest console logs and create an archive that is available for download, click Troubleshoot > Create Console
Log Archive.
8. To download the console log archives, click Troubleshoot > Download Archived Console Logs.
NOTE:
● Currently, for any M1000e chassis discovered with chassis firmware version of 5.1x and earlier, the date in the
TIMESTAMP column under Hardware Logs is displayed as JAN 12, 2013. However, for all chassis versions of VRTX
and FX2 chassis, the correct date is displayed.
● The file will not be immediately ready for download especially in cases where there is a large set of logs being collected.
The collection process happens in the background, and a file save prompt is displayed when the operation is completed.
Related information
Forward audit logs to remote Syslog servers on page 115
15
120 Monitor audit logs