Monitoring events

To view or export the Events page, your role needs to be granted View permissions for Audit Event History. All Administrators are granted this permission by default.

To open the Events page, click on the navigation bar.

The Events page includes a default collection of event information organized in the following columns:

• Date: the date and time when the event occurred

• Event: the event that occurred
• Summary: shows details about the event, such as the user who initiated the event, the device that was affected, and the name of the item that was changed and its changed fields.

  A icon indicates that a new page will open when you click the link. Depending on the type of event and the information shown, you can:

  • Click a username to open the Users page in Settings > User Management.
  • Click a device name to view the device's Device Details page.
  • Click a rule name to open the rule configuration dialog.
  • Click a device group to view the devices in the group.
  • Click a geofence A boundary that defines the geographical area within which you allow (or disallow) your devices to reside. name to view the geofence's boundaries on a map.
  • Click a place name to view location details.
  • Click a theft report ID to view the report details.
  • Click a role to view its permissions and assigned users.

  For "updated" events, click the link or click More to open a pop-up dialog showing the properties that were updated and their old and new values:

  Column	Description
  Property Name	The field or property that was updated.
  Old Value	The previous value associated with the item.
  New Value	The new value associated with the item.

  Example

  A device location updated event is logged. Clicking the place name opens a pop-up dialog showing old and new values for Longitude, Latitude, Quality (accuracy in meters), Country, State, and City.

Events are retained in the database for 30, 90, or 365 days, depending on the event type. For example, session timeout events are retained for 30 days while cryptographic wipe completed events are retained for 365 days.

View the data retention period for each event type

NOTE  Data retention periods conform to Absolute data processing policies and are subject to change without prior notice.

By default, the following filter is used to generate the Events page:

Date within last 7 Days

You can change the number of days in the Date filter.

NOTE  Depending on the data retention periods of the displayed events, setting the Date filter to a value greater than 30 days may not generate additional results.

You can also click to filter events by:

• Device

  Begin entering the device's device name, serial number, or Absolute Identifier and then select the device from the selection list

• Event

  Select a condition and then select an event from the list of events

• User

  Begin entering the user's name, username, or user account status (Active, Suspended, or Temporarily Suspended) and then select the user from the selection list

Filtering "updated" events

You can filter "updated" events based on their old or new field values.

To filter "updated" events:

1. Click and click Select Field.
2. Search for one of the following events:

   • Device location updated

   • Device user information updated

   • Disk updated

   • Network adapter updated

   • Operating system updated

   • Role updated

   • Rule updated

   • Script updated

   • Smart device group updated

   • Static device group updated

   • System information updated

   • User updated

   • Volume updated

3. Click the icon next to the event and select a data field to filter by.
4. Select a condition and then enter a field value.

Example

You want to find all Windows devices that have upgraded to the latest Windows update in the last 7 days. You add the following filter to the default view of the page: Operating system updated > Build is <Windows update build number>.

For more information about working with filters, see Editing report filters.

While you are viewing a page or report, its data is not updated dynamically as new data becomes available. To show the most recent data available in the system, such as information that was just uploaded from a device, click the icon in the bottom left of the page. The Last updated field updates to the current date and time.

You can click > Save as to save the page as a new report. You can access your report in the My Reports view of the Reports page. Any filter, column, and sort customizations that you added to the page are saved to the new report.

You can click > Export to export the page as a report and download it to your computer. If you've edited the page's filters or added or removed columns, your changes are reflected in the exported report, even if you don't actively save your changes.

Before exporting the Events page, note the following:

• Changes to the page's default sort order are not exported.

• If there are multiple property changes associated with an event, each change shows on a separate row in the exported report.

• Depending on the total number of events included in your export, it may take a few minutes to export the report.

The following columns are included in the exported report:

NOTE  If your account includes more than 20,000 devices, the Events page may contain hundreds of thousands of events. Filter the page to show the events of interest and then export it in CSV (.csv) format. Excel (.xlsx) format does not support extremely large reports (> 1 million rows).