Search <book_title>...

Enterprise Vault™ Auditing

Last Published: 2022-09-04

Product(s): Enterprise Vault (14.3)

About this guide
1. Introducing this guide
2. Where to get more information about Enterprise Vault
  1. Enterprise Vault training modules
Introducing Enterprise Vault auditing
1. About Enterprise Vault auditing
Setting up auditing
Viewing the audit database entries
Auditing for data protection compliance
1. Auditing general delete operations
  1. Example query search for general item delete audit entries
2. Auditing privileged delete operations
  1. Example query search for privileged delete audit entries
Appendix A. Format of audit database entries
1. The format of audit database entries

Starting or stopping auditing

You can enable or disable auditing across all the Enterprise Vault servers in the site at once, or for individual servers.

When auditing is started or stopped, event ID 4288 reports whether auditing is running (enabled) or stopped (disabled), the status of each audit category, and the identity of the administrator who made the change. When the Enterprise Vault Admin service starts, event ID 4286 is reported if auditing is running and event ID 4287 is reported if auditing is stopped. An audit database entry is also created with the same information.

To start or stop auditing

In the Administration Console, right-click the Enterprise Vault Servers container and, on the shortcut menu, click Configure Auditing.
On the Centralized Auditing tab, select or clear the audit categories.
On the Server Settings tab, do the following:
- To enable or disable auditing across all the Enterprise Vault servers in the site, select or clear the check box next to the Auditing column header.
- To enable or disable auditing for individual servers, select or clear the check box for that server row in the Auditing column.
Click Apply, and then click OK to save the settings.