You are viewing limited content. For full access, please sign in.

Question

Question

Browse Entry vs View Content

Audit Trail
Updated September 18, 2020
asked on July 22, 2020

So in Audit Trail, you have to enable View Content in order to run reports on who viewed a document.  Any chance the Browse Entry and View Document options can be separated?

People are way more interested in who opened a document than how browsed and searched.  Its seem that bundling those two items in the same View Content results in way larger log files when not needed.

0 0

Answer

SELECTED ANSWER
replied on July 23, 2020 • Show version history

Hi Chris,

Good news! This separation already exists. Even though they're in the same Audit Event Class of "View Content", you can actually audit one without the other. The "Browse Entry" event is split out as a separate audit toggle called "Entry Listing" in Admin Console, specifically because it does generate huge and usually unnecessary log files.

Audit Trail Event Descriptions

 

Cheers,

Sam

1 0

Replies

replied on July 23, 2020

Great, thanks Sam, I guess I was confused on how it was listed in the documentation.  Thanks for the clarification.

1 0
replied on September 16, 2020

Hello Sam,

If the customer has View Content checked for the Everyone Group, will this cause the log file to grow quite large?

Thanks,

Jeff Curtis

0 0
View 6 previous replies
replied on September 16, 2020

Yes. See the help file.

0 0
replied on September 16, 2020

Thanks Miruna

So if they want to use this Event, they should allocate necessary space to handle the logfile growth.

Is there any other options the user can use to get some of the search function they want without creating a large logfile. 

 

0 0
replied on September 16, 2020

Can you elaborate on "some of the search function they want"?

0 0
replied on September 16, 2020

Hey Sam,

So customer would like to know which documents were viewed by users.  I can't find another AT Event to use other than View Content to fulfill the request to keep the Logfile growth down.

Thanks,
Jeff

0 0
replied on September 16, 2020

If they want to know which documents users view, that's exactly what View Content does. You'll get one audit log entry every time a user opens a document.

I'd enable View Content on Everyone for a week and check the before and after audit directory sizes to get an idea for log growth rate and how much you actually need to plan for. It might not be so crazy.

Consider setting the audit logs to roll over daily instead of based on size as well.

Make sure to leave Entry Listing off. That one will cause orders of magnitude more audit entries than View Content.

0 0
replied on September 17, 2020

Hey Sam,

Thanks.  We had just View Content on for the Everyone Group and the logfile grew pretty large (5gb) pretty quick (About 7 hours).

We know they have high volume users, which looks to be the cause for this.

I will pass along your suggestion to the IT Group.

Thanks Again,

Jeff Curtis

0 0
replied on September 17, 2020

It's worth taking a look at the logs and seeing if Workflow/Quick Fields/etc. accounts are generating a significant portion of the audit entries. If so, and you don't actually need to be auditing such non-human-user access, there are ways to exclude the service accounts.

0 0
replied on September 18, 2020

Hello Sam,

Would we be able to see this in the LF Admin Console for these accounts and the Aduit Tab?

Thanks,
Jeff Curtis

0 0
replied on September 18, 2020

If you're asking how to check if the service accounts are generating an appreciable percentage of the audit events, run Audit Trail queries with User filters to get counts from your 7h test period. 

If they are, and you're asking about how to exclude them, you'll need a People group and a Services group. Treat the People group like an EveryoneButServiceAccounts group. Populate its membership as appropriate.

 

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...