Audit Trail

Table of Contents

Getting Started

The Audit Trail feature allows you to track the operations of users who have access to the CommCell. This capability is useful when you want to determine the source of a detrimental operation that was performed in the CommCell environment. Information about audited operations is saved in the CommServe database. Data is kept according to the data retention settings for Audit Trail in the CommCell Console Control Panel.

Verify the Default Retention Days for Each Severity Level

  1. In the CommCell Console ribbon, select the Home tab, and then click Control Panel.
  2. Click Audit Trail.
  3. Review the Retention in Days settings by severity level in the Audit Trail dialog box.

    Click OK.

Generate Audit Trail Report

For more information and instructions on running the report, see Audit Trail Report.

Severity Levels

By default, operations performed in the CommCell environment are grouped into four severity levels. A record of each audited operation is retained for a specific number of days, based on the operation's severity, as shown in the table below:

Severity Level Type of Operations included Examples Default Retention days
Critical Operations that delete data. Deleting a backup set; deconfiguring an agent. 365 days
High Operations that might delete data. Changing client encryption properties or media management configuration. 365 days
Medium Operations that change the general configuration of one or more entities in the CommCell, which may produce unintended results. Exporting media; killing a job. 240 days
Low Operations that change status, add entities, and other operations that have minimal impact on existing CommCell functions. Compliance searches; setting container information for Vault Tracker actions.

See Operations Recorded for Audit Trail for a list of operations.

120 days

Operations Recorded by Audit Trail

The following table lists the operations that are recorded at each severity level:

Severity Level

Operation

Critical Abort Media in VaultTracker Action
Critical Change Client CommServe Host Name
Critical Change Client Host Name
Critical Change Client Name
Critical Change SharePoint Archiver Prune Settings
Critical Close Case
Critical Create Case
Critical Deconfigure a Storage Node in Library and Drive Config Tool
Critical Delete a Client Group
Critical Delete a Library
Critical Delete a Mount Path
Critical Delete Backup Set
Critical Delete Case
Critical Delete Client from Search Engine
Critical Delete Content Director Legal Hold
Critical Delete Content Director Policy
Critical Delete Content Director Record Center
Critical Delete Content Director Search
Critical Delete Content Director Tag
Critical Delete Content Index for Job
Critical Delete Content Indexing for Storage Policy
Critical Delete Custom Calendar
Critical Delete Deduplication for Storage Policy Copy
Critical Delete Disk Media Content
Critical Delete ERM Connector
Critical Delete Export Location
Critical Delete History of VaultTracker Action
Critical Delete Iron Mountain Customer ID
Critical Delete Media
Critical Delete Media Container
Critical Delete Media Contents and Move Media
Critical Delete Replication Policy
Critical Delete Replication Set
Critical Delete Schedule
Critical Delete Schedule Policy
Critical Delete Search Engine
Critical Delete Snapshot
Critical Delete Spare Group
Critical Delete Storage Policy
Critical Delete Storage Policy Copy
Critical Delete User
Critical Delete User group
Critical Delete VaultTracker Policy
Critical Deleted Filer Management
Critical Disable Backups for Storage Policy Copy
Critical Disallow Copy Jobs in Media
Critical Erase Backup Data
Critical Erase Media
Critical Execute QScript
Critical Export and Delete Media
Critical Failed Login
Critical Full Erase Media
Critical Full Erase Media in Library
Critical Hard Delete Client
Critical Hard Delete iDataAgent
Critical Job Based Pruning
Critical Kill All Jobs
Critical Mark Recall Done for Media in VaultTracker Action
Critical Move Media between Libraries
Critical Oracle RMAN Cross-Check Disabled
Critical Oracle RMAN Cross-Check Enabled
Critical Quick Erase Media
Critical Quick Erase Media in Library
Critical Recall Media
Critical Release license for Agent
Critical Release license for MediaAgent
Critical Release licenses for client
Critical Remove Deduplication Access Path
Critical Revert Snapshot
Critical Update Custom Calendar
Critical Update Storage Policy Copy Properties
High A SCSI2 reservation release was attempted for a drive but failed.
High Add New User
High Add New User Group
High Allow Export
High Allow Recopy Data in Media
High Allow Recopy Job
High Change Network Password
High Change Storage Policy Copy Data Path
High Change Subclient Content
High Control Services
High Create Subclient
High Deconfigure Instance
High Delete Instance
High Delete Replication Pair
High Delete Snap Volume Unit
High Delete Subclient
High Delete Subclient Policy
High Delete Workflow
High Deleted Schedule Holiday
High Disable Schedule Policy
High Disallow Content Indexing for Jobs
High Do Not Retain Job
High Execute QScript
High Migrate Disk Library
High Reach Destination for Media in VaultTracker Action
High Reassociate Bulk Subclients
High Reassociate Individual Subclients
High Reassociate Subset of Subclients
High Resume Export for Media in VaultTracker Action
High Return Media in VaultTracker Action to Source
High Rollback History of VaultTracker Action
High Scheduled job ran
High Suspend Export for Media in VaultTracker Action
High Tape Catalog Merge
High Update Activity Control
High Update Case
High Update Client Encryption Properties
High Update Content Indexing Properties for Storage Policy
High Update Deduplication Access Path
High Update Instance Properties
High Update Library Properties
High Update Storage Policy Properties
High Update Subclient Properties
High Update User Group properties
High Update VaultTracker Policy
High User group Enable/Disable
High Web service Failure Login
Medium Add a Deduplication Access Path
Medium Add a Mount Path
Medium Add Blind Media
Medium Add Custom Calendar
Medium Add Media Barcode Pattern
Medium Add New Media Container
Medium Add Operation Window
Medium Add Snap Volume Unit
Medium Add Spare Group
Medium Add Subclient Policy
Medium Add Workflow
Medium Allow Content Indexing for Jobs
Medium Allow Copy Job
Medium Allow Copy Jobs in Media
Medium Change Index Cache Retention Days
Medium Change Media Barcode Pattern
Medium Change SAN Switch
Medium Change Storage Policy Copy Precedence
Medium Change Storage Policy Properties for Moving Snapshots to Backup Media.
Medium Change Subclient Post-Command
Medium Change Subclient Pre-Command
Medium Change the Host for a Storage Node in Library and Drive Config Tool
Medium Change Threshold for Drive Maintenance
Medium Change Threshold for Library
Medium Change Threshold for Media Expiration
Medium Changed Filer Management
Medium Changed Schedule Holiday
Medium Client Configuration Policy Modified
Medium Client user profile Operation
Medium Clone Content Director Legal Hold
Medium Clone Content Director Policy
Medium Clone Content Director Record Center
Medium Clone Content Director Search
Medium Clone Content Director Tag
Medium Clone ERM Connector
Medium Clone Storage Policy
Medium Clone Subclient Policy
Medium Configure a Storage Node in Library and Drive Config Tool
Medium Configure the Whole Storage Node in Library and Drive Config Tool
Medium Create Content Director Legal Hold
Medium Create Content Director Policy
Medium Create Content Director Record Center
Medium Create Content Director Search
Medium Create Content Director Tag
Medium Create Content Indexing for Storage Policy
Medium Create ERM Connector
Medium Create New Backup set
Medium Create New Instance
Medium Create Schedule
Medium Create Schedule Policy
Medium Create Share Folder Operation
Medium Create Storage Policy
Medium Create Storage Policy Copy
Medium Create Subclient
Medium Create Sync Folder Operation
Medium Created Filer Management
Medium Created Schedule Holiday
Medium Delete Media Barcode Pattern
Medium Delete Operation Window
Medium Description modified
Medium Disable Content Director Legal Hold
Medium Disable Content Director Policy
Medium Disable Content Director Record Center
Medium Disable Content Director Search
Medium Disable Content Director Tag
Medium Disable Deduplication Access Path
Medium Disable ERM Connector
Medium Disable Schedule
Medium Discover Media
Medium Drive Cleaned
Medium Drive Replaced
Medium Enable Content Director Legal Hold
Medium Enable Content Director Policy
Medium Enable Content Director Record Center
Medium Enable Content Director Search
Medium Enable Content Director Tag
Medium Enable Deduplication Access Path
Medium Enable ERM Connector
Medium Enable Schedule
Medium Enable Schedule Policy
Medium Execute QScript
Medium Execute QScript
Medium Export Media
Medium Export Media from Library
Medium Export Media from Library through VaultTracker
Medium Export Media through VaultTracker
Medium Kill Job
Medium Mark Media Bad
Medium Mark Media from Foreign CommCell Reusable
Medium Mark Media Full
Medium Mark Media Good
Medium Mark Partial Full
Medium Mark Volume Full for Storage Policy Copy
Medium Media Reuse Allowed
Medium Media Reuse Prevented
Medium Migrate Media
Medium Modify alerts subscription preference.
Medium Modify MediaAgent properties
Medium Mount Snapshot
Medium Move All Media to Spare Group
Medium Move Number of Media to Spare Group
Medium On Demand Failover for Storage Policy Copy
Medium Pick Job for Data Verification
Medium Pick Job for Moving Snapshots to Backup Media
Medium Pick up Media in VaultTracker Action
Medium Prevent Export
Medium Rename Case
Medium Rename Snap Volume Unit
Medium Rename Spare Group
Medium Rename Subclient
Medium Rename Subclient Policy
Medium Rename Workflow
Medium Replace a Storage Node in Library and Drive Config Tool
Medium Retain Job
Medium Security Name Server Settings
Medium Share Folder Operation
Medium Sync Folder Operation
Medium Unmount Snapshot
Medium Unpick Job for Moving Snapshots to Backup Media
Medium Update Application properties
Medium Update Backup set properties
Medium Update Backup Set Properties
Medium Update Client properties
Medium Update Client properties - Client group association
Medium Update Content Director Legal Hold
Medium Update Content Director Policy
Medium Update Content Director Record Center
Medium Update Content Director Search
Medium Update Content Director Tag
Medium Update Deduplication Properties
Medium Update ERM Connector
Medium Update Export Location
Medium Update Instance properties
Medium Update Iron Mountain Customer ID
Medium Update Media Container
Medium Update Media Management Configuration Parameter
Medium Update Media Properties
Medium Update Operation Window
Medium Update Schedule
Medium Update Schedule Policy
Medium Update Share Folder Operation
Medium Update Snap Volume Unit
Medium Update Spare Group Properties
Medium Update Subclient Policy
Medium Update Subclient properties
Medium Update Sync Folder Operation
Medium Update User
Medium Update User group association
Medium Update Workflow
Medium User Login
Medium User Logout
Medium Verify Media
Low A SCSI2 reservation was released for a drive, and the reservation release was successful.
Low Add Export Location
Low Add Iron Mountain Customer ID
Low Add Media Container
Low Annotation
Low Blind Media Full Inventory
Low Blind Media Quick Inventory
Low Compliance Search
Low Download Item
Low Dummy Operation - please replace.
Low ERM Submission
Low Execute QScript
Low Export Client Pass Phrase
Low Full Library Scan
Low Legal Hold Item
Low Mark Drive Fixed
Low Mark Media Exported
Low Media Catalog
Low Quick Library Scan
Low Reset Client Pass Phrase
Low Restore process
Low Review Set Operation
Low Set Container for Media in VaultTracker Action
Low Tagging
Low Web Console download Operation
Low Web service User Login