You are viewing limited content. For full access, please sign in.

Question

Question

Audit Trail - Why some events are not displayed right away

asked on November 20

We have Audit Trail setup to show the last 90 days, and many events display in the reports as soon as they occur. For example Successful Logins.

However Failed Logins do not show immediately, we are still waiting on many of the failed login tests to show, even though new successful logins are coming right up.

Why are some events taking longer to be processed and prepared for the report? How long should they wait before they are looking at accurate data?

0 0

Replies

replied on November 20

Are you running a server with an edition of Audit Trail that allows tracking failed events?

Are you using Directory Service for login? If login failed at Directory Service level (from say Forms or the web client redirecting the user there to authenticate), the event is not audited in the repository since it never made it to the Laserfiche Server.

 

1 0
replied on November 20

It is Advanced Audit Trail. It has support for failed everything in the configuration where we choose what to audit. I mean I can see my first failure test so it's not a matter of not auditing failures, but subsequent tests do not show up, yet subsequent successful login tests do show up. This is why I am confused as to it being out of order, why would I see my latest successful login but not my last failed login while testing?

This environment does not use Directory Server at all.

0 0
replied on November 20

They wouldn't be out of order, it sounds like the even is not being audited. But there isn't enough information to troubleshoot. I'd recommend opening a support case and attaching screenshots of your configuration and event logs.

0 0
replied on November 20

I am going to jump on a VAR Webinar Tuesday to get some help with it.

0 0
replied 7 hours ago

Opened a support case to get this configured. Over 90% of our failed logins are still not showing up days later, where successes show up right away and we have verified many successful logins without ever not seeing one. A very small fraction of failures show right away but we can not figure out any difference between those failures and any other failure.

We are the ones testing and we are failing from the same app, the same machine, nothing changes between one failure and the next.

I found a post where in 2018/2019 audit trail was not tracking any failed logins but it was fixed in 10.4 and they are up to 10.4.1

1 0
You are not allowed to follow up in this post.

Sign in to reply to this post.