Working with the Audit Logs

By default, the Audit Logs screen will provide a comprehensive list of activity from the last 24 hours. The top of the Audit Logs screen may be used to select one or more filters to narrow the scope of the log. The bottom portion of the screen is used to display all of the selected log activity.

The Audit Log List

	Click this icon to update/refresh the Audit Log
	Click this icon to download the Audit Log list currently displayed on the screen

The Audit Log displays all of the user actions that fulfill any of the applied filters. For each entry, the system provides a description, resource, user, and the date and time. Here are a few of the most common entries:

• Create user session: A user has signed into the system.
• Delete current session: A user has signed out of system.
• View WebRTC stream: The user added a Player (in WebRTC mode) to the Stage, or changed the Player mode to WebRTC.
• View LBM stream: The user added a Player (in Low-bandwidth mode) to the Stage, or changed the Player mode to Low-bandwidth mode.
• Move PTZ: The user moved a PTZ camera to a new position.
• Export video: The user exported video from a specific Player.
• Confirm server properties update: The user saved changes to the Orchid configuration file.

1. Use the scrollbar on the far right side to scroll up and down through the list.
2. Click on any entry to expand it and view details.
   1. Click on the entry again to collapse it.
3. To refresh the list (with the most current activity), click the Refresh icon.
4. To return to the top of the Audit Log, click the Return to Top icon.
5. To export the log currently displayed on-screen, click the Export icon. (The Audit Log will be saved as a .CSV file.)

Sorting the Audit Log

You can sort the Audit Log by the date and time of the entries, so you can start your review with the newest events or the oldest events.

1. To sort the list, click the arrow icon at the top of the Date/Time column.
   1. Each time you click the icon, the sort order will switch between ascending and descending.

Filtering the Audit Log

The Audit Log may be filtered to display only the activities that you specify. You may filter the list using any one or more of the four filter types. These include a date/time filter, user filter, camera filter, and an advanced filter.

*Keep in mind that some filter combinations will not return results. For example, if you search for a specific user and a specific camera, the system will only return results for activity that meets both of those filter criteria.

1. To filter the Audit Log, click in the Filters field to expand it.

2. To filter the list by date:
   1. Click on the Past 24 Hours button. The Select Date Range dialog will open.
      1. Click on the filter start date, then the end date.
      2. Then edit the start and end times, if needed.
      3. Click OK, when done. (The filter start and end dates will now appear on the button.)
   2. Click the Search button to apply the filter and review the results.
3. To return the date filter to the last 24 hours, click the X on the date filter button, then click Search or Refresh.

4. To filter the list by User:
   1. Click on the Filter by User section to expand it.
      1. Mark the checkbox next to any User that you want to monitor. (You may select more than one.)
   2. Click the Search button to apply the filter and review the results.
5. To clear the User filter, click the X on each User filter button, or unmark each User checkbox. Then click Search or Refresh.

6. To filter the list by camera:
   1. Click on the Filter by Camera section to expand it.
      1. Mark the checkbox next to any camera that you want to monitor. (You may select more than one.)
   2. Click the Search button to apply the filter and review the results.
7. To clear the camera filter, click the X on each camera filter button, or unmark each camera checkbox. Then click Search or Refresh.

8. To filter the list using advanced filters:
   1. Click on the Advanced Filters section to expand it.
      1. Mark the checkbox next to any authentication type that you want to monitor. (You may select more than one.)
   2. Click the Search button to apply the filter and review the results.
9. To clear the advanced filter, unmark each checkbox, then press Search or Refresh.

10. To clear all filters, click the Reset button.
11. Click the Search button to view the updated list.