Specifying a Time Range

1. Click the date-time range at the top right of the Audits tab to open a range selector.

   
   

   
   
   

2. Select one of the pre-defined ranges.

   To enter a specific time range, choose Custom range and use the controls in Selected Range to specify start and end dates and times.

3. Click Apply.

Adding a Filter

1. Click the Filters link.

   
   

   
   
   

   The Filters pane displays.

2. Click if a filter field is not already open.
3. Choose a field in the Select Property drop-down list.

   The properties correspond to the audit fields listed in Service Audit Events.

4. Choose an operator in the operator drop-down list.

   Choose from = (equals), != (not equals), like, and not like. The like operator matches to substrings. For example, to see all the audit events for files created in the folder /user/joe/out, specify Source like /user/joe/out.

   Use not like to filter out events based on a partial string match. For example, to show audit events for a set of IP addresses that start with the same sequence 172.39.109, you can specify IP Address not like 172.39.109.
5. Type a field value in the value text field.

   For example, to see the events listed for Navigator, enter Service Name = Navigator.

6. To specify an additional filter, click and define the new criteria.

   Audit events show that match all filters (AND).

7. Click Apply.

   A filter breadcrumb appears above the list of audit events and the list of events displays all events that match all the filter criteria.

Removing a Filter

1. Click the x next to the filter breadcrumb.

   
   

   
   
   

You can also click Filters and modify or remove filter criteria.