cancel
Showing results for 
Search instead for 
Did you mean: 

How to Find the AUdit Entries

Ahmed_Abd_ElGel
Level 4
Partner Accredited

Dears,

I've an enviroment Having EV Version 8. i enable the AUditing in my EV server,

Really i need an informative report for the AUdit ENtries to be presented regualary to my manager

 

can the EV 8 represent such report or i should go to SQL and start build the report manually

 

thanks

AHmed ABd ElGelil

2 REPLIES 2

Peable
Level 6
Employee Accredited Certified

Hi there,

I know this isn't great... have a look in Admin guide for EV8, Chapter 21. It tells you a bit more. I used the Utility "Audit Viewer", see the utility guide, Chapter 2. That's not perfect either, but gives you the basic functionality at hand.

Hope that helps,
Jochen.

Joseph_Rodgers
Level 6
Partner

Ahmed,

 

Jochen nailed it.  The Audit Viewer is not great but the great thing is the data is now in sql.  I wrote some quick sql query and dumped to excel, everyone is happy.

 

If you have Crystal reports or are good with access it is the easiest of all the EV DBs to query (I even did a join from EVDirectory to get user names!)

 

Here's a headstart:

 

--This query will show Archive access per user for specified time period

USE EnterpriseVaultAudit

SELECT SUM(CASE WHEN auditdate > '10-17-2008 02:00' AND vaultid != 1 AND Categoryid = 2 AND objectid is not null THEN 1 ELSE 0 END) AS "Archived Access Count", em.mbxDisplayName as "Mailbox Name"

FROM AuditTrail at

Join Users u on u.userid = at.userid

Right Join EnterpriseVaultDirectory.dbo.ExchangeMailboxEntry EM on u.username = '<domain>\'+em.MbxAlias

group by em.MbxDisplayName

order by em.MbxDisplayName

 

-Joe