Auditing activities

The Auditing page allows you to track user actions and monitor activities in BMC Helix Continuous Optimization. To access the Auditing page, navigate to Administration > System > Auditing.

Related topics

Adding-and-managing-entity-catalogs

Managing-and-maintaining-ETL-and-System-Tasks

The following table describes the options on the Auditing page:

Name	Description
Filter action groups	Filters messages in the Audit messages table. You can filter messages based on the following activities: User Logins: Actions related to user authentication. Example: User login, Login attempt. User Activity: Actions triggered by users. Example: Analysis run, System configuration changed. System Component Activity: Actions related to system components. Example: Configuration data loaded, Task started. Scheduler Activity: Actions related to the schedulers. Example: Scheduler started, Scheduler task error. External Tool Activity: Actions related to external tools. Example: ETL module activation, Configuration download. User Administration Activity: Actions performed by users with administrator privileges. Example: modifying hierarchy rules, system tasks, performing reconciliation of entities.
Display audit messages for	Select a period for which you want to view the audit message details in the table. For example, last 7 days, 24 hours. The default filter options are: All Last 6 hours Last day Last 7 days Last 30 days
Audit messages	Lists all audit messages saved in BMC Helix Continuous Optimization. This table contains the following columns: Timestamp: The date and time on which the message was recorded. Action: Action that triggered the message. For example, Object loaded, User Login. Message: Audit message stored by BMC Helix Continuous Optimization. For example, User 'Admin' logged out. Component: The component affected by the action. For example, Web, Gateway Server. Subcomponent: The subcomponent affected by the action. For example, The ETL task with ID 1234 (displayed as etlid:1234). For more information on Subcomponent IDs and to view their details, see Understanding the Subcomponent column in the Audit messages table. Username: The username that triggered the action. Identifier: The unique identifier of the object affected by the action. For example, The system with ID 5678 (displayed as sysid:5678). For more information on Identifier IDs and to view their details, see Understanding the Identifier column in the Audit messages table. Elapsed: Duration of the action (in seconds).

Understanding the Subcomponent column in the Audit messages table

The Subcomponent column displays the Task IDs of the sub-components affected by the action performed by a particular user. When you click the link, you can view details of the subcomponent that was affected.

The displays of task IDs in this column depend on your selection in the Filter action groups list. Selecting each action group displays related task IDs. Some action groups do not display any IDs. For example, if you filter on User Logins and User Activity, the Subcomponent column does not display any task IDs, while filtering on System Component Activity displays task IDs for the Subcomponent affected.

Some common types of task IDs that are displayed in the Subcomponent column are described in the following table:

Task ID	Description
etlid:n	Denotes an ETL task
srcid:n	Denotes the Source ID for the task

To view details of tasks listed in the Subcomponent column

If you click on a task ID listed in the Subcomponent column, the Auditing page displays details of the particular task for which an audit was recorded. The following image displays the task ID in the Subcomponent table.

For example, when you click an ETL Task with an ID, the Auditing page displays all details for the selected ETL Task, such as, Run History, Run Configurations, and so on.

Understanding the Identifier column in the Audit messages table

The Identifier column displays IDs of objects affected by the action performed by a particular user. When you click the link, you can view details for the selected object.

The values displayed in this column depend on your selection in the Filter action groups list. Selecting each action group displays related IDs. Some action groups do not display any IDs.

Some common types of IDs that are displayed in the Identifier column are described in the following table:

ID	Description
seriesid:n	Denotes a Series
sysid:n	Denotes a System
modelid:n	Denotes an event model
reportid:n	Denotes a report
analysisid:n	Denotes an analysis
appid:n	Denotes an application

To view details of tasks listed in the Identifier column

If you click on an ID listed in the Identifier column, the Auditing page displays details of the particular task for which an audit was recorded. The following image displays the ID in the Identifier table.

For example, after you click a model with an ID, details for the model, such as the domains it is used in and its hierarchy location, are displayed in the Workspace tab. To return to viewing the Audit messages table, use your browser's back button.

Aging values for audit actions

The Aging value is a numeric value that indicates the number of days audit message data is retained. It differs for each Audit Action and is not consistent across Audit Action Groups. The following table displays the Aging value configured for each Audit Action in the respective Audit Action Group.

Audit Action Group	Audit Action	Aging Value
User Logins	User login	10
	User logout	10
	Login attempt	10
User Activity	Object inserted	60
	Object updated	60
	Object deleted	60
	View or download	10
	Run	10
	Analysis run	10
	Model run	10
	System configuration changed	60
	Generated an API key	90
	ETL data deleted	120
System Component Activity	Entity creation error	30
	Object creation error	30
	Custom data loaded	30
	Custom data updated	30
	Custom data deleted	30
	Optimizer alert	60
	Analysis run (scheduled)	10
	Model run (scheduled)	10
	Object inserted	30
	Object updated	30
	Object deleted	30
	Task started	10
	Task ended	10
	Object inserted from ETL	30
	Object relationship transaction loaded	30
	Data loaded	10
	Configuration data loaded	10
	Object loaded	10
Scheduler Activity	Scheduler restart	30
	Scheduler killed	30
	Scheduler started	30
	Scheduler stopped	30
	Mail sent	30
	Mail failure	30
	Scheduler has dismissed an entity	90
	Scheduler has purged an entity	90
	Scheduler has purged entity series	90
	Scheduler task error	10
	Scheduler has inactivated entity	90
External Tool Activity	Configuration download	10
	ETL project Uploaded	60
	ETL project Downloaded	30
	ETL module Activation	60
	ETL module Deactivation	60
	Configuration download failure	30
	ETL project deleted	90
User Administration Activity	Manual entity reconciliation	90
	Task creation	60
	Task scheduling request	60
	Task unscheduling request	60
	Task reconfiguration	60
	BCO user account creation	60
	BCO user account edit	60
	View creation	60
	View update	60
	Alert rule creation	60
	Alert rule update	60
	Event rule creation	60
	Event rule updated	60
	Custom metric creation	60
	Event rule deleted	60
	Task deleted	60
	Task updated	60
	Run configuration created	60
	Run configuration updated	60
	Run configuration deleted	60
	Alert rule deleted	60
	View deleted	60
	Task kill request	60
	Task run request	60
	Hierarchy rule run request	60
	BCO user account deleted	60
	Lastcounter edit	60
	Lastcounter deleted	60
	Lookup shared	60
	Lookup unshared	60
	Scheduler instance created	60
	Scheduler instance updated	60
	Scheduler instance deleted	60
	Entity reconciliation	60
	Dashboard deleted	60
	Dashboard group deleted	60
	Dashboard group updated	60
	Dashboard group created	60
	Dashboard updated	60
	Dashboard created	60
	ETL engine creted	60
	ETL engine updated	60
	ETL engine deleted	60
	Task stop request	60
	Scheduler restart requested	60
	Scheduler stop requested	60
	Entity Catalog created	60
	Entity Catalog updated	60
	Entity Catalog deleted	60
	Diagnostic Alert suppressed	60
	Add ETL to a Shared Entity Catalog	60
	Add ETL to Private Entity Catalog	60
	Formula created	60
	Formula updated	60
	Formula deleted	60
	Metric profile deleted	60
	Metric profile created	60
	Metric profile updated	60
	Open ETL template created	60
	Open ETL template updated	60
	Open ETL template deleted	60
	Threshold update	60
	Revoke API token	60
Helix Dashboard Report Activity	Recipient list created	30
	Recipient list updated	30
	Recipient list deleted	30
	Report result deleted	30
	Report created	30
	Report deleted	30
	Report updated	30
	Manual report run	30
	Report generated	30