Audit log

The audit log provides a chronological record of the following events:

• Operations that are performed by users in Management Portal
• Operations with cloud-to-cloud resources that are performed by users in the Cyber Protect console
• Cyber Scripting operations that are performed by users in the Cyber Protect console
• Operations related to email archiving
• System messages about reached quotas and quota usage

The log shows events in the tenant in which you are currently operating and its child tenants. You can click an event to view more information about it.

Audit logs are stored in the datacenter and their availability cannot be affected by issues on end-user machines.

The log is cleaned up on a daily basis. The events are removed after 180 days.

Audit log fields

For each event, the log shows:

• Event

  Short description of the event. For example, Tenant was created, Tenant was deleted, User was created, User was deleted, Quota was reached, Backup content was browsed, Script was changed.

• Severity

  Can be one of the following:

  • Error

    Indicates an error.

  • Warning

    Indicates a potentially negative action. For example, Tenant was deleted, User was deleted, Quota was reached.

  • Notice

    Indicates an event that might need attention. For example, Tenant was updated, User was updated.

  • Informational

    Indicates a neutral informative change or action. For example, Tenant was created, User was created, Quota was updated, Scripting plan was deleted.

• Date

  The date and time when the event occurred.

• Object name

  The object with which the operation was performed. For example, the object of the User was updated event is the user whose properties were changed. For events related to a quota, the quota is the object.

• Tenant

  The name of the tenant that the object belongs to.

• Initiator

  The login of the user who initiated the event. For system messages and events initiated by upper-level administrators, the initiator is shown as System.

• Initiator's tenant

  The name of the tenant that the initiator belongs to. For system messages and events initiated by upper-level administrators, this field is empty.

• Method

  Shows whether the event was initiated via the web interface or via the API.

• IP

  The IP address of the machine from which the event was initiated.

Filtering and search

You can filter the events by type, severity, or date. You can also search the events by their name, object, tenant, initiator, and initiator's tenant.