Gathering audit logs

Modified on Wed, 06 Sep 2023 at 02:18 AM

As an administrator, you can collect audit log that record the events that occur across the following CafeX services:

Tenant events
1. Records events that apply to your CafeX tenant.
2. For example: When an administrator updates the tenant settings.
Workspace events
1. Records events that occur on workspaces in your tenant.
2. For example: When someone adds someone else to a workspace.
User events
1. Records events that correspond to members of your organization
2. For example: When a member updates their profile.
Workspace entry events
1. Records events that occur on specific workspace entries events.
2. For example: When someone views a workspace entry.
Other events are for specific CafeX functionality.

Audit records are available to administrators for 12–months.

Accessing the audit logs page

The audit logs page is found in the Tenant settings section, which is accessible through the three-dot menu in the page header.

The audit logs page can then be access by the Auditing item in the Management group.

As an administrator, to search your audit logs:

The search may take a few seconds to complete, and applicable audit records appear in the table.

If there are a lot of records they may not all be visible, click Fetch additional to retrieve more.

To search across all of the audit records for your organization, select All services and All event types.

To view additional information for each audit record, click Details. The Audit event details opens.

You can see specific attributes that you can use use in subsequent searches.

For example:

Each Workspace entry has a unique objectID field that you can use to find all corresponding events to a file on a workspace.
If you search for a workspaceID you can find all of the events that occur on the Workspace you specify.

The following fields are available on all audit records:

Attribute name	Attribute description
`id`	Identifies an audit record.
`service`	The corresponding CafeX service for an audit record.
`type`	The event type for an audit record.
`action`	Specifies whether the action taken was successful or unsuccessful.
`message`	Provides more detail about the event in an audit record.
`accountId`	Identifies the CafeX tenant that the event occurs in.
`objectId`	Identifies an object that an event takes place on. Objects can be an entity in CafeX, for example: a file, a URL, a Workspace, a meeting.
`userEmail`	The email address of the person that carries out an operation,
`userId`	identifies the person that carries out an operation.
`userAccountId`	Identifies the tenant that the person carrying out an operation is part of.
`trackId`	Identifies the Workspace that the event took place on, or `null` otherwise.
`timestamp`	The timestamp when the event occurs.
`changes`	Any additional information or attributes that correspond to the event.

After completing a search, to download the results, click Download.

The file that downloads contains all of the audit records that are in your search result, in JSON format.

Typically, you can process JSON records using another application.