Audit Reports Results

Depending on the report criteria you choose on the Audit Report panel, an audit report can show:

The search criteria that users entered to search for messages in the entire archive or in their personal archives

The criteria that users entered to create audit reports

Messages that users accessed in the archive

Messages that were exported or purged from the archive

A list of users who viewed a specific message, including the dates and times that they viewed it

Return to the Audit Report panel to change or enter new report criteria.

Display the report in a printer-friendly format. You can then print the report using your browser’s Print option.

If the report contains a large amount of data, Postini recommends that you download the report first, and then print it. Printing a large report from Message Archiving may cause your web browser to time out.

Download

Save a copy of the report on your computer, in either of these formats:

HTML: This file opens in a printer-friendly format in your browser.

CSV: Comma-separated values. This file is compatible with spreadsheet or data-analysis programs.

The date and time at which the archive event occurred.

Investigator

The email address of the archive user who performed the activity. (This is the address with which the user logged in to your Postini Message Security service to access the archive.)

Type

The type of activity that the user performed. The possible activity types are:

Search: The user searched for messages in the entire archive, using the search panels available on the Search tab or the Discovery tab.

Access: The user viewed the contents of a message retrieved by a search of the entire archive.

Personal Archive Search: The user searched for messages in his or her Personal Archive.

Personal Archive Access: The user viewed the contents of a message retrieved by a search of his or her Personal Archive.

Audit Search: The user created an audit report, using the Reports tab.

Export: The user exported the search results.

Purge: The user purged messages from the entire archive.

Search History: Access and Personal Archive Access

Shows details about the search that the user conducted:

Search Values: The text that the user entered in the fields on the search panel.

Note: The search values do not show:

Specific fields in which the user entered the text on the search panel

Email addresses and IM names, if the user who searched the archive used the Company Directory panel to enter them on the search panel

Archive Query: The query that Message Archiving created, based on the search criteria that the user entered, in Lucene query syntax. Therefore, you can copy the query syntax and paste it on the Boolean Search panel to re-run the user’s search (if your account has the Archive Search privilege).

Note: An archive query appears only if you choose the Show Query option on the Audit Report panel.

Search History: Access and Personal Archive Access

Shows a summary of the message that the user accessed.

Note: A message summary does not include all the users who received the message, such as recipients on the CC list. To view complete information about a message, click View Message.

View Message/View Conversation/View File: Displays the complete content of the email message, IM conversation, or IM file transfer. This link is available only if your user account has the Archive Search privilege. If you click this link, your email address is added to the list of viewers for the message.

Show All Viewers: Displays a list of the email addresses of the users who have accessed this message—that is, displayed its content in the archive or exported it from the archive. The dates and times that each user viewed or exported the message are included.

Note: Message Archiving takes up to 5 minutes to add a user to this list after the user views the message. If a message is displayed with the indication that no users have viewed the message, click this link again in a few minutes to refresh the list.

Search History: Audit Search

Shows the date range for the audit report that the user created.