Audit Report Panel

1.	Click Reports tab.

2.	In the navigation panel, click Audit Reports.

Use the Audit Report panel to:

Enter the criteria by which you want to create an archive audit report.

Options on the Audit Report panel:

Specify the date range for the audit report. Select dates in the drop-down lists, or click the Calendar icons and select dates. You can choose any range of dates up to 370 days.

Note:

Data for a report is available for any dates in the past, back to the date on which Message Archiving was activated for your company.

A report does not include messages that were purged from the archive according to your retention policy.

Message Archiving uses the time zone set for your user account to search for the date in archive activities.

Searches by

Specify the investigators for whom you want to view archive activities by entering the complete email address of each investigator, such as jasonl@jumboinc.com

Separate multiple addresses with a comma or semicolon.

Look Up

Open the Company Directory panel, with which you can search for users’ email addresses. For details, see Company Directory Panel.

Searching the entire archive

Include activities that users performed in the corporate archive, using the Search tab or the Discovery tab. These users have access to the corporate archive.

Depending on the archive activities (audit events) you choose to display, this option shows the search criteria that users entered and the messages they viewed.

Searching a personal archive

Include activities that users performed in their Personal Archives.

Depending on the activities (audit events) you choose to display, this option shows the search criteria that users entered and the messages they viewed.

Running an audit report

Include audit report activities that users performed using the Reports tab. These users have privileges to create audit reports.

This option shows the date range the user selected for the audit report.

Message Access Events

Show the archived messages that the users accessed—that is, any messages in the search results that the user either viewed in the archive or exported from the archive. These messages can include email messages and IM conversations and IM file transfers (if your service includes Postini IM Security).

In the audit report, these messages are listed with the type Access or Personal Archive Access.

Search Events

Show the search criteria that users entered to search for messages in the archive—that is, the date range and any other values, such as sender and recipient addresses and keywords.

In the audit report, search criteria are listed with the type Search, Personal Archive Search, or Audit Search.

Show Query

For Search Events, include the complete query that Message Archiving created based on the search criteria the user entered. Message Archiving queries are in Lucene query syntax.

Note: You can use this query to re-run a user’s archive search, by copying it and pasting into the Boolean Search panel on the Search tab or Discovery tab (if your account has the Archive Search privilege).

Message Export Events

Show the exports that users performed, including the date of each export, the number of files exported, the number and overall size of messages in the exported file, and whether or not the file was encrypted.

Purge Events

Show the purges that users performed, including the date of each purge, and the number and overall size of the purged messages.

Select Sort Order

Display audit report activities in order, according to one of the following criteria:

Newest first: Sorts the results newest-to-oldest, according to the dates on which the activities occurred.

Oldest first: Sorts the results oldest-to-newest, according to the dates on which the activities occurred.

Investigator: Displays the activities alphabetically, according to the email addresses of the users who performed them.