You are viewing limited content. For full access, please sign in.

Question

Question

Audit Trail - Why some events are not displayed right away

Audit Trail
Updated December 4, 2020
asked on November 20, 2020

We have Audit Trail setup to show the last 90 days, and many events display in the reports as soon as they occur. For example Successful Logins.

However Failed Logins do not show immediately, we are still waiting on many of the failed login tests to show, even though new successful logins are coming right up.

Why are some events taking longer to be processed and prepared for the report? How long should they wait before they are looking at accurate data?

0 0

Replies

replied on November 20, 2020

Are you running a server with an edition of Audit Trail that allows tracking failed events?

Are you using Directory Service for login? If login failed at Directory Service level (from say Forms or the web client redirecting the user there to authenticate), the event is not audited in the repository since it never made it to the Laserfiche Server.

 

1 0
View 3 previous replies
replied on November 20, 2020

It is Advanced Audit Trail. It has support for failed everything in the configuration where we choose what to audit. I mean I can see my first failure test so it's not a matter of not auditing failures, but subsequent tests do not show up, yet subsequent successful login tests do show up. This is why I am confused as to it being out of order, why would I see my latest successful login but not my last failed login while testing?

This environment does not use Directory Server at all.

0 0
replied on November 20, 2020

They wouldn't be out of order, it sounds like the even is not being audited. But there isn't enough information to troubleshoot. I'd recommend opening a support case and attaching screenshots of your configuration and event logs.

0 0
replied on November 20, 2020

I am going to jump on a VAR Webinar Tuesday to get some help with it.

0 0
replied on November 24, 2020

Opened a support case to get this configured. Over 90% of our failed logins are still not showing up days later, where successes show up right away and we have verified many successful logins without ever not seeing one. A very small fraction of failures show right away but we can not figure out any difference between those failures and any other failure.

We are the ones testing and we are failing from the same app, the same machine, nothing changes between one failure and the next.

I found a post where in 2018/2019 audit trail was not tracking any failed logins but it was fixed in 10.4 and they are up to 10.4.1

1 0
replied on December 2, 2020

Some useful info that was causing at the very least confusion while testing. The following events are not logged even in Advanced Audit Trail.

Failed login attempts for Windows Accounts

Failed login attempts with a blank password

Failed login attempts for a username that does not exist

0 0
replied on December 4, 2020

Reference ID 286582

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...