Audit

To see what happened, when, and who was involved, open Audit. Each OpenLM service reports notable activity (logins, configuration changes, errors, and other operations) to Audit, which collects the events into a single Events list you can filter, inspect, and export. Audit is a read-only view that helps you troubleshoot problems.

Before you begin

Confirm these prerequisites:

• An OpenLM Platform account with an administrator role: Account Administrator, System Administrator, or a dedicated Audit administrator role. Users without one of these roles don't see Audit in the Navigation menu and can't open it.

Audit is one of the OpenLM system products, so it is always active for your account. Each account sees only its own events. For more information, see Access and permissions.

To open Audit, select Navigation (the grid icon in the OpenLM Platform header), then Platform Administration, then Audit.

For related tasks, see OpenLM Products, Alerts, and Notifications.

What Audit shows

Audit aggregates events emitted by OpenLM Platform components so you can review them in one place. Use it to:

• Troubleshoot problems by finding the errors a component recorded and reading their descriptions.
• Track activity across OpenLM Platform: which component did what, when, and for which user.
• Investigate a specific action, such as a failed sign-in or a configuration change, without opening each component separately.

Every event is a single record with a fixed set of fields: the System Component that reported it, a severity Type, the Date and Time it occurred, an event Name, the User it relates to, and a free-text Description. Audit doesn't modify or generate events itself. It only displays what other components report.

Open the Events list

To review events, select Reporting, then Events in the navigation pane. Events is the only list in Audit. It has three parts:

• Filter bar: The System Component, Type, Name, and User filters, with the Apply and Clear buttons.
• Toolbar: The Date and Time range picker, and the Export CSV, Refresh, and Search controls.
• Results grid: The list of matching events.

For an in-app summary of how the filters and buttons work, select the information icon (ⓘ) next to the Events heading.

When you first open the list, the grid is empty and shows the prompt "Select and apply the "Filters" to get the report". To load results, select Apply.

The following image shows the filter bar and the results grid:

Events list with the filter bar and the results grid

Filter events

To narrow the events, use the four filters. Each is a multi-select list whose options come from the events in your account, so you only select values that exist in the data.

The following table lists the filters and what each narrows by:

Filter	What it narrows by
System Component	The OpenLM component that reported the event, for example OpenLM.SecurityService, BrokerHub, LicenseAccessControl.API, VirtualLicenseManager, or OpenLM.ProductsService.
Type	The event severity: Information, Warning, or Error.
Name	The event name, such as Successful login or GetPhysicalLicenseManagersList.
User	The user the event relates to.

To run a report:

1. Open one or more filters and select the values you want.

   Each filter has a search box for finding values in a long list.

2. Select Apply.

   The grid loads the events that match every filter you set.

To start over, select Clear. This empties all four filters and reloads the full, unfiltered list of events. If you select Apply with no filters, Audit returns all events for your account.

The following image shows the System Component filter open:

Each filter is a searchable, multi-select list populated from your account's events

Narrow by date and time

To restrict the report to a time window, use the Date and Time picker in the toolbar. It's optional and independent of the filter bar. By default, no date filter is applied and the report covers all recorded events.

To pick a window:

1. Select the calendar.
2. Select a preset in the Select Preset menu (Last 7 Days, Last 30 Days, Last 60 Days, Last 180 Days, or Last 360 Days), or select Custom and pick the start and end dates.

The grid reloads for the selected range. The following image shows the picker:

The Date and Time picker limits the report to a preset or custom time window

Search within the results

To find text in the loaded events, enter it in the Search box in the toolbar. Audit highlights the text wherever it appears in the events shown in the grid. Search is a highlight aid for scanning a loaded page, not an additional filter, and it doesn't change which events the report returns. To change the result set, use the filters and the date range instead.

View event details

The Description column is truncated in the grid. To read an event in full:

1. Hover over its row.

2. Select the View icon at the end of the row.

   The Event Description dialog opens with the event's complete details: System Component, Type, Date and Time, Name, User, and the full Description.

3. Select the close (✕) icon to return to the grid.

The following image shows the Event Description dialog:

The Event Description dialog shows an event's full details

Sort and page through results

To sort by a column, select its header. To reverse the order, select the header again. Every column can be sorted except Description.

The results are paged. Use the Items per page control and the page arrows at the bottom of the grid to move through large result sets. Selecting Refresh in the toolbar reruns the current report.

Export to CSV

To download the report, select the Export CSV icon in the toolbar. The export includes all events that match the current filters and date range, not only the page shown on screen, and applies the current sort order. The file is named Audit Events.csv and contains the same columns as the grid: System Component, Type, Date and Time, Name, User, and Description. CSV is the only export format.

Event types

Audit classifies every event with one of three severities:

Type	Meaning
Information	A normal operation was recorded, such as a successful sign-in or a routine query.
Warning	A condition worth noting that did not stop the operation.
Error	An operation failed. The Description usually explains why.

Columns

The following table lists the columns of the results grid:

Column	Description
System Component	The OpenLM component that reported the event.
Type	The event severity: Information, Warning, or Error.
Date and Time	When the event occurred, shown in your configured date format and time zone.
Name	The name of the event.
User	The user the event relates to.
Description	A free-text description of the event, truncated in the grid and shown in full in the Event Description dialog.

Access and permissions

Audit is available to administrators only. To open Audit, your OpenLM Platform account must have an administrator role: an Account Administrator, System Administrator, or a dedicated Audit administrator role. Users without one of these roles don't see Audit in the Navigation menu and can't open it.

Events are scoped to your account: you see only the events recorded for your own OpenLM account, never those of other tenants.

Data retention

Audit keeps events for a limited time rather than indefinitely. In OpenLM Platform, OpenLM manages event storage and retention. In on-premises deployments, a scheduled job removes events older than a configurable retention period (90 days by default). Export the events you need to keep with Export to CSV before they age out.