View Tranaction History

[Carl_Swanson]

How can I view the transaction history of a vault store? I've got a few people reporting missing items or nothing after a certain day and I'm a little concerned cause some of these users are on legal hold and they had been added to a rentention group of forever. Our users can not delete from their vaults as a failsafe for accidental deletions so I need to try and vew the history.

EV 9.01

-THanks

[TonySterling]

Do you have auditing enabled?  Really though, for something this serious I would open a case with support. 

[Carl_Swanson]

Yes, I have auditing enabled. Haven't really used it yet though :) You mean you're not the support Tony? Yeah, was going to open a case. Just have had a few too many odd things going on.

-Thanks

-Carl Swanson

Regal Entertainment Group

[TonySterling · Accepted solution]

I do my best, but no. 

Ok, depending on what you have been auditing you should be able to get some good info.

In the program files for EV there is an AuditViewer.exe.  There isn't a lot of documentation about it but it is pretty simple.

[JesusWept3]

Remember that if a retention category is set to forever, it just means that storage expiry will not delete those items until they are 9999 years old, that being said users can still delete those items if the Retention category does not have the checkbox marked saying Prevent Deletion, if this is checked the. It means nothing can delete the items, not a user delete, not a storage expiry and not a deletion of the entire users archive If you go to the Vault Store database, there is a table named Journal Delete you can query against, will have the item, it's deletion date, the archive and the folder it belongs to as well as the deletion reason Also if you go to the users archive properties in the vault admin console you will also have a deleted items tab where you can restore all the items provided that you have the Dumpster turned on which by default is set to keep items for 14 days And you can also scour the IIS logs for any mentions of deleteo2k.asp which covers the large majority of deletion requests that a user would make, this would cotton their archive ID, saveset ID, IP Address the request came from and the windows NT Username that made the request Another thing too is that if you give users the ability to manually archive, depending on the client hey have and how your policies are configured, it could be thatthe items were archived using a retention that you may not necessarily want them to use. And last but not least it could be that if you have Moved Items enabled that users are moving items from one location to another and simply misplacing them