Monitoring events

The Events page in the History area shows a log of the events triggered by a user, a device, or the system. You can view details about each event, search for a particular event of interest, and filter the page based on one or more criteria. By default, the page shows events over the past 7 days, but you can update the page's filters to show up to 30 days of event history.

List of logged events

NOTE  If you want to be notified by email when an event occurs, or when multiple events occur within a specific time frame, create a rule. Learn more

Accessing the Events page

To view the Events page, your role needs to be granted View permissions for Audit Event History. All Administrators are granted this permission by default.

To open the Events page, click on the navigation bar.

Filters

The following filters are used to generate this page:

Date within last 7 Days

Information included on the Events page

The Events page includes a default collection of event information organized in the following columns:

  • Date: the date and time when the event occurred
  • Event: the event that occurred
  • Summary: shows details about the event, such as the user who initiated the event, the device that was affected, and the name of the item that was changed and its changed fields.

    A icon indicates that a new page will open when you click the link. Depending on the type of event and the information shown, you can:

    • Click a username to open the Users page in Settings > User Management.
    • Click a device name to view the device's Device Details page.
    • Click a rule name to open the rule configuration dialog.
    • Click a device group to view the devices in the group.
    • Click a theft report ID to view the report details.
    • Click a role to view its permissions and assigned users.

    For "updated" events, click the link or click More to open a pop-up dialog showing the properties that were updated and their old and new values:

    Column

    Description

    Property Name

    The item that was updated.

    Old Value

    The previous value associated with the item.

    New Value

    The new value associated with the item.

Filtering events

You can filter the events on the Events page by Date, Event, User, or Device. For example, to find all missing devices that have been reported found in the last 30 days, change the Date filter from 7 to 30 days and add the following filter: Event is Missing device found.

NOTE  Setting the Date field to a value greater than 30 days does not generate additional results. Events are retained in the database for 30 days only.

You can also filter "updated" events based on their old or new field values. For example, to find all Windows devices that have upgraded to the latest Windows update in the last 7 days, add the following filter to the default view of the page: Operating system updated > Build is <Windows update build number>.

For more information about working with filters, see Editing report filters.

NOTE  In the current release, some fields that are available in the Event drop-down list in filters are not supported at this time. If you attempt to filter the report based on one or more of these fields, the report will not show any results. Therefore, when filtering the Events page always refer to the list of logged events.