System Audit Report
The enhanced System Audit Report, previously the Workflows Audit Report, features a more intuitive way to display audit information, including easier access to data and more filter options. This report consolidates system-wide information for audit purposes, including users, devices, and workflows.
The System Audit Report includes audit records for when users, devices, workflows, HTTP triggers, and custom steps are added, modified, or deleted. Company supervisors can use the report to review and troubleshoot changes to the users and workflows in their system.
Each record in the report indicates the name of the user, device, workflow, custom step, or HTTP trigger that was changed, when the change occurred, details about what was changed (including before and after values, where available), where the change was made, and who made the change. For more details, see How to read changes in an audit record.
Use the System Audit Report
The following sections describe actions you can perform in the System Audit Report:
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
In the Reports menu, under Audit, click System Audit Report.
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
To more easily view data in the report, do one or more of the following:
- To sort the content of a column in chronological order, click the column header. (Click the header again to reverse the sort order.)
- To change the width of a column, move the pointer over the edge of the column and when the re-size icon appears, click and drag the column to the desired size.
- To rearrange the columns, click and drag a column header to a new location on the table.
- If the list contains more entries or columns than can be displayed on your screen, scroll horizontally or vertically. The system automatically loads more data as you scroll the page.
- To include or exclude columns, click the Columns drop-down menu and select or clear the columns that are included. When you've hidden a column and want to see it again, it is added as the last column of the table.
See Available data columns for descriptions of each column.
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
You can quickly search for audits that contain the search term. Start typing in the search bar and the report automatically updates the list to display audits that contain the search term.
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
The report displays data for a specific timeframe. You can select particular timeframes (Past 24 Hours, Past 7 Days, Past 30 Days, Past 60 Days, or Past 90 Days), or specify a date range using the calendar and time pickers and click Apply. The results in the report update to match your timeframe or date range.
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
The available filters allow you to narrow the audits list based on matching specific criteria. For example, you can use filters to locate audit records for changes made to a particular workflow by a specific person or people (e.g., audit records for changes made to the Incident Resolution workflow by Mary McBride or Aarohi Kaur).
You can apply one or more filters to narrow down the list of audit records. If you apply multiple filters, xMatters only returns record that match all of the specified filter criteria. For detailed instructions on how to use filters, see Filtering data tables.
The following table describes the available filters on the System Audit Report and their values:
Filter | Values |
Name |
|
Changed |
|
Changed By |
|
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
Click Export to open or save the report's currently displayed results as a spreadsheet.
Understand the System Audit Report
The following sections provide more information on how to navigate the System Audit Report and interpret the data within each audit record:
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
The Workflows Audit Report includes the following columns:
Column | Description |
Time | The date and time of the change. |
Changed | What was changed: User, Device, Workflow, Custom Step, or HTTP Trigger. For more information on each change, see Data components. |
Name |
The name of the user, device, or workflow, or the name and version of the custom step or HTTP trigger. |
Changes | Details about the change. To learn how to interpret the data in this column, see How to read changes in an audit record. |
Changed By |
The first name, last name, and user ID of who made the change. |
Interface | The product interface where the change was made: Web UI, API, or Not Available. |
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
The Workflow Audit Report records changes to the following components:
Changed | Component |
User |
|
Device |
|
Workflow |
|
HTTP Trigger |
|
Custom Step |
|
![Closed](../../Skins/Default/Stylesheets/Images/transparent.gif)
When constant changes occur within your organization, it may be difficult to find the audit record you need in the System Audit Report even after you've utilized the filter, sort, and search functions to narrow down the list. Learn how to read and interpret the data in the Changes column of an audit record to quickly find what you're looking for:
Added
When a component is added, the Changes column records the name of the component and any corresponding settings that have been configured for it during creation. For example, if you add a user, you would see the following in an audit record:
- Changed column: The type of change, which in this case is "User".
- Name column: The first name, last name, and user ID of the new user.
- Changes column: The action that occurred, which in this case is adding a user. The column lists the name of the new user and the settings that were configured at the time of creation.
Deleted
When a component is deleted, the Changes column records the name of the component that was removed. For example, if you delete a workflow, you would see the following in an audit record:
- Changed column: The type of change, which in this case is "Workflow".
- Name column: The name of the deleted workflow.
- Changes column: The action that occurred, which in this case is deleting a workflow.
Updated
When a component is updated, the Changes column records the name of the component and the changed setting's old value for reference along with the newly updated value. For example, if you update a trigger in a workflow, you would see the following in an audit record:
- Changed column: The type of change, which in this case is "Workflow".
- Name column: The name of the updated workflow.
- Changes column: The action that occurred, which in this case is updating a flow trigger in a workflow. The column lists the name of component (the flow trigger) and the settings that were configured during the update, including old and new values when applicable. (e.g., If you disabled the flow trigger, the change would look like: 'Is Enabled: Enabled ➔ Disabled'. The updated setting is "Is Enabled", the old value is "Enabled", and the new value is "Disabled".)
Multiple changes
When multiple components are updated at the same time (e.g., a team member relocates and they update their sites, languages, and time zone), the report lists them all in one record when possible. Some changes may be listed in separate records due to how the data is processed. To confirm if multiple records were changed at the same time by the same user, check if the Time and Changed By column values are the same for the records you're looking at.