The Events page in the History area shows a log of the events associated with your account that were triggered by a user, a device, or the system. You can view details about each event, search for a particular event of interest, and filter the page based on one or more criteria. By default, the page shows events over the past 7 days, but you can update the page's filters to show up to 365 days of event history.
NOTE If you want to be notified by email when an event occurs, or when multiple events occur within a specific time frame, create a rule. Learn more
To view or export the Events page, your role needs to be granted View permissions for Audit Event History. All Administrators are granted this permission by default.
To open the Events page, click on the navigation bar.
The Events page includes a default collection of event information organized in the following columns:
- Date: the date and time when the event occurred
- Event: the event that occurred
- Summary: shows details about the event, such as the user who initiated the event, the device that was affected, and the name of the item that was changed and its changed fields.
A icon indicates that a new page will open when you click the link. Depending on the type of event and the information shown, you can:
- Click a username to open the Users page in Settings > User Management.
- Click a device name to view the device's Device Details page.
- Click a rule name to open the rule configuration dialog.
- Click a device group to view the devices in the group.
- Click a geofence A boundary that defines the geographical area within which you allow (or disallow) your devices to reside. name to view the geofence's boundaries on a map.
- Click a place name to view location details.
- Click a theft report ID to view the report details.
- Click a role to view its permissions and assigned users.
For "updated" events, click the link or click More to open a pop-up dialog showing the properties that were updated and their old and new values:
The field or property that was updated.
The previous value associated with the item.
The new value associated with the item.
A device location updated event is logged. Clicking the place name opens a pop-up dialog showing old and new values for Longitude, Latitude, Quality (accuracy in meters), Country, State, and City.
Events are retained in the database for 30, 90, or 365 days, depending on the event type. For example, session timeout events are retained for 30 days while cryptographic wipe completed events are retained for 365 days.
View the data retention period for each event type
NOTE Data retention periods conform to Absolute data processing policies and are subject to change without prior notice.
By default, the following filter is used to generate the Events page:
Date within last 7 Days
You can change the number of days in the Date filter.
NOTE Depending on the data retention periods of the displayed events, setting the Date filter to a value greater than 30 days may not generate additional results.
You can also click to filter events by:
- Begin entering the device's device name, serial number, or Absolute Identifier and then select the device from the selection list
Select a condition and then select an event from the list of events
Begin entering the user's name, username, or user account status (Active, Suspended, or Temporarily Suspended) and then select the user from the selection list
You want to find all Cryptographic Wipe requests submitted by [email protected] in the last 30 days. You update the filters as follows:
You can filter "updated" events based on their old or new field values.
To filter "updated" events:
- Click and click Select Field.
- Search for one of the following events:
Device location updated
Device user information updated
Network adapter updated
Operating system updated
Smart device group updated
Static device group updated
System information updated
- Click the icon next to the event and select a data field to filter by.
- Select a condition and then enter a field value.
You want to find all Windows devices that have upgraded to the latest Windows update in the last 7 days. You add the following filter to the default view of the page: Operating system updated > Build is <Windows update build number>.
For more information about working with filters, see Editing report filters.
While you are viewing a page or report, its data is not updated dynamically as new data becomes available. To show the most recent data available in the system, such as information that was just uploaded from a device, click the icon in the bottom left of the page. The Last updated field updates to the current date and time.
You can click > Save as to save the page as a new report. You can access your report in the My Reports view of the Reports page. Any filter, column, and sort customizations that you added to the page are saved to the new report.
You can click > Export to export the page as a report and download it to your computer. If you've edited the page's filters or added or removed columns, your changes are reflected in the exported report, even if you don't actively save your changes.
Before exporting the Events page, note the following:
Changes to the page's default sort order are not exported.
If there are multiple property changes associated with an event, each change shows on a separate row in the exported report.
Depending on the total number of events included in your export, it may take a few minutes to export the report.
The following columns are included in the exported report:
The date and time when the event occurred
The event that occurred
One of the following:
One of the following:
The name or identifier of the object that was also affected by the event, such as the request ID of a Freeze request
For "updated" events, the field or property that was updated
NOTE For some other events, this column contains additional information that is not shown on the Events page. For example, IP address and Browser agent show in this column for User login events.
The previous value associated with the property
The new value associated with the property
NOTE If your account includes more than 20,000 devices, the Events page may contain hundreds of thousands of events. Filter the page to show the events of interest and then export it in CSV (.csv) format. Excel (.xlsx) format does not support extremely large reports (> 1 million rows).