You are viewing limited content. For full access, please sign in.

Question

Question

Delay before new new audit events start collecting data in LF Cloud?

asked on February 26, 2020 Show version history

We enabled a few audit events earlier today and still do not see any activity for these events in audit trail.

For example, we enabled Failure on Session events (to log failed log on attempts) and also Search events. After that, I waited a few minutes and then logged out and attempted to log back in with the wrong password a few times. I also performed various searches. Even now, I can run an audit trail report for all Session events and see new successful log on events, but no failed events. I also do not see any data at all when looking for Search events.

I've made sure the report filters would allow me to capture such events (looking for all users, data range is correct, etc).

How much delay should we expect before new audit event data starts populating?

0 0

Replies

replied on December 20, 2024

Just to add to this post incase any one has a client needing to confirm if past items that were not audited will be loaded after enabling auditing for them in cloud, the answer is no.  I had to double check with LF support when it came up with a client to be sure.

1 0
replied on March 5, 2020

hi, Dustin Briles  in lf cloud, audit event data takes approximately 30 min.

0 0
replied on March 5, 2020

Weird. It took the better part of a day for Search events to start populating.

 

According to our Solution Provider, you cannot audit failed log in attempts to LF Cloud as specified above - apparently for both the web and desktop clients the authentication would fail at ACS and not ever make it to the LF Cloud server, so the failed log in attempt would never be registered.

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.