Cloud Software Group, Inc. EBX®
Documentation > Administration Guide > Technical administration
Navigation mode Documentation > Administration Guide > Technical administration

# Audit trail

## Overview

The audit trail feature allows to log all views access and user services launch in TIBCO EBX®.

The feature is disabled by default; to enable audit trail logging, configure the `audit` logging category with a level that enables `INFO` messages.

##### See also

- Activating the audit trail

## Log content

The information logged by audit trail comes in 2 parts: the common header and the event-specific content described in the following sections.

### Common header

Here are the header attributes that are always logged:

user-login | Login of the user
user-ip | IP address of the user, when available
event | Type of event performed by the user, among the following value: TABULAR_ACCESS: when a tabular view is accessed in the UI; HIERARCHY_EXPAND_NODE: when a node is expanded in a hierarchical view, or when the view is displayed; HIERARCHY_EXPAND_ALL: when several nodes are expanded in a hierarchical view; DATASPACE_PERMISSION_TABULAR_ACCESS: when the permission table for a dataspace is accessed; DATASET_PERMISSION_TABULAR_ACCESS: when the permission table for a dataset is accessed; USER_SERVICE: when the export, compare, or validate built-in service, an addon or a custom user service is launched.

### Table view events

This section describes the events specific to table views, which are:

- TABULAR_ACCESS

- HIERARCHY_EXPAND_NODE

- HIERARCHY_EXPAND_ALL

- DATASPACE_PERMISSION_TABULAR_ACCESS

- DATASET_PERMISSION_TABULAR_ACCESS

These events are triggered when the table view is opened or refreshed, when a search is performed and when the user navigates using pagination.

Here are the content attributes specific to these events:

dataspace | Key of the dataspace containing the table
dataset | Key of the dataset containing the table
table | Path of the table being accessed (does not apply to permission events)
view-id | Identifier of the custom view currently applied if any (does not apply to permission events)
view-name | Published name of the custom view currently applied if any (does not apply to permission events)
pagination-info | Information about the pagination of the tabular view or the expanded node
hierarchy-expanded-node | Identifier of the node being expanded (only applies to hierarchy events). When several levels are expanded (search or expand all), it is the node on the higher level. The identifier is the node label prefixed by ":". The root node is identified as ":". When a hierarchy is initially displayed, only the root node is expanded so the event is HIERARCHY_EXPAND_NODE.
filters | All filters applied to the view, aggregated in a JSON format. There are 3 kinds of filter: `quick-search`: user input in the quick search field, if any; `structured-search`: user advanced filters configured using the advanced search panel in a JSON format, if any; `view-filter`: filter defined by the view in a XPath format, if any. For instance:
    filters={"structured-search":["starts-with","/field/city","city"],"view-filter":"matches(./country,'France')"}

### User service

Here are the content attributes specific to this event:

service-key | Service key of the service being executed
service-mode | A service can be executed on any intermediate level of the selection entity. For example, if the current selection entity is a record, then the service may be executed on the following levels: dataspace, dataset, table or a record. This attribute allows to define on which level of the selection entity the service is executed.
selection | Entity selection on which the service is executed (branch or version, dataset, etc.) in a JSON format. When more than 100 records are selected, only the 100th first records are logged.
service-parameters | Additional input parameters specified for the service execution : for built-in services, see the list of parameters; for custom services, the parameters are specified in the declaration; for addon services, see the addon documentation.

## Legacy XML Audit trail (deprecated)

XML audit trail logs data updates to XML files. This legacy feature, now deprecated, will be removed in a future version. Although this type of audit trail should no longer be used, the legacy documentation is still available.

Documentation > Administration Guide > Technical administration