Viewing a device's events

On the History page, you can view a device's events over a particular period of time. The following types of events are available:

Events that occurred on a device may take up to 15 minutes to show on the History page (assuming the device is online), while events that were triggered by a console user may take up to 1 minute.

To view a events on a device's History page, your user role must be granted the View permission for both Device reports and Audit Event History.

To view location updated events, your user role must be granted the View permission for Geolocation.

To generate an AI summary of location history and see low confidence tags for device location updated events, your user role must be granted the View permission for AI Assistant and the Address-level view permission for Geolocation.

All administrator roles are granted these permissions.

To view the event information for a device:

  1. On any page that shows linked device identifiers in the first column of the results grid, such as the All Devices page in the Devices area, click the link for the device that you want to view. Summarized information about the device shows in the page header.
  2. Click History.

A new page opens to show a timeline of the device's events, and an overview of the first event in the timeline.

You can use the timeline to view the device's events.

By default, the timeline shows a history of the device's events over the last year (366 days), in descending chronological order, but you can change the date range. Events in the History page have the same data retention period as events in Event History.

Depending on the device's event history, one or more of the following items may show on the timeline:

To filter the timeline to only show location updated events, click .

A location updated event occurs when either of the following events are logged:

An event that occurs when the device moves from one Wi-Fi, GPS, or OS location to another. Learn more

The timeline shows:

  • Device location updated events in one of the following formats:

    • Moved to <city name>: the device moved from one city to another

    • Moved within <city name>: the device moved to a new location in the same city

  • The full street address of the device's new location

    If you don't have Address-level View permissions for Geolocation, the timeline only displays the name of the city the device moved to.

  • The date and time when the location was detected on the device

  • The geotechnology used

  • A Low confidence tag to the right of the event if AI analysis determines that the location change is unlikely to represent an actual physical device movement. Low confidence tags are shown only if the AI summary of location history feature is enabled for your account and only after you generate the summary for the device.

  • Location updated events are logged only when the Geolocation Tracking policy is activated in the device's policy group, and the device changes its location by more than 100 meters.
  • For stolen devices, location updated events are not logged while the theft investigation is open. Note that after it's closed, location information that was collected during the investigation is not included in the device's location history.

If the Geolocation setting is enabled, and all other locations were unavailable or invalid when the location change occurred, an IP location is reported, and a Public IP location updated event is logged. Learn more

Note that IP locations are based on a device's public IP address, and location accuracy is typically low.

To show Public IP location updated events in the timeline, select the Show IP location checkbox. The timeline shows:

  • The city, state/province, and country of the location. Street addresses are not available.

  • The date and time when the IP location was detected on the device

Click the event to view more information in the event overview.

A Device entered a geofence event occurs when a device moves to a new location that is inside the boundaries of a geofence. A Device exited a geofence event is logged when a device moves to a new location that is outside a geofence.

The timeline shows the date and time when the event occurred. Click the event to view more information in the event overview.

Geofences are created and managed in Settings > Geofences.

This event is logged when either of the following events occur:

The timeline shows the date and time when the event occurred.

To filter the timeline to only show device usage events, click .

A device usage event occurs when a user's session state changes on the device. The timeline shows the type of device usage event that occurred. Click the event to view more information in the event overview.

Device usage events only apply to devices with an active Device Usage policy.

Data is available for device usage events that occur after the activation date of the Device Usage policy. After activating the policy, you'll need to wait at least a few days before you can see data on the Usage page. Also note the following:

  • To capture logout and lock activities, the device must be running Secure Endpoint Agent version 7.23 or higher.

  • To capture sleep, wake, and shutdown activities, the device must be running Secure Endpoint Agent version 8.0 or higher.

The following types of device usage events are supported (depending on the device platform):

  • Device login: A user logged in to the device, either directly or remotely, by entering their username and password on the login screen.
  • Device logout: A user or system logged out of the device and all applications are closed.
  • Device unlocked: A user unlocked the device, either directly or remotely, by dismissing the Lock screen (if applicable) and entering their password on the login screen.
  • Device locked: A user or system locked the device. The user is still logged in to the device and open applications are still running, but a username and password is required to unlock the device.
  • Device slept: A user or system put the device in sleep mode. The user is still logged in to the device, but all actions are paused.

    Note that if multiple sleep/wake cycles occur during a 5 minute window, only one Device slept event is logged. However, if a Device slept event is followed by a Device login, Device logout, Device locked, or Device unlocked event, the 5-minute timer resets.

  • Device woke up: A user or system woke the device up from sleep mode.

    Note that if multiple sleep/wake cycles occur during a 5 minute window, only one Device woke up event is logged. However, if a Device woke up event is followed by a Device login, Device logout, Device locked, or Device unlocked event, the 5-minute timer resets.

  • Device shutdown: A user or system restarted or turned off the device.

Device login and Device unlocked are the only activities that apply to Chromebook devices.

Depending on the device's operating system, power settings, and the method used to power off the device, you may see different events. For example, when you restart a Windows device and unlock it with a password, Device logout, Device shutdown, and Device unlocked events are recorded. When you restart a Mac device and unlock it with a password, Device shutdown and Device login events are recorded.

When the device is restarted using a hard reset (the power button is held down to restart the device), only a Device login event is recorded.

In addition, the total number of hours and minutes that the device's screen was unlocked during each 24 hour period shows as (xh xm in use) under the date.

A Windows or Mac device is deemed to be in use if it is unlocked. Activity ceases when the screensaver shows, the monitor is powered off, or the device is locked or shut down.

A Chromebook device is deemed to be in use if the display is active (not dimmed). Activity ceases when the display is dimmed, or the device is sleeping, locked, or shut down.

Note that if a device shuts down unexpectedly, the most recent activity is saved.

To filter the timeline to only show system updated events, click .

A system updated event occurs when system or user information is updated on the device. The timeline shows the date and time when the event occurred. Click the event to view more information in the event overview.

The following events or types of events are supported (depending on the device platform):

  • Agent events

  • Custom Data field updated
  • Custom field updated
  • Device unenrolled by Refurbishment partner
  • Device user information updated
  • Disk events
  • License updated on device
  • Network adapter events
  • Operating system updated
  • Refurbishment processing
  • Refurbishment blocked

  • System information updated

    In the timeline, the event label shows the name of the system information property that was updated (for example, Time zone updated or Device name updated.

  • Volume events

To filter the timeline to only show compliance-related events, click .

A compliance event occurs when the security or compliance status of a device changes. The timeline shows the date and time when an event occurred. Click the event to view more information in the event overview.

The following events or types of events are supported (depending on the device platform and its activated policies):

  • Anti-malware events

  • Application became compliant

  • Application became non-compliant

  • Application compliance check failed

  • Application non-compliant reason updated

  • Application remediated

  • Application remediation failed

  • Device added to policy group

  • Device became compliant
  • Device became non-compliant
  • Device compliance reason updated

  • Encryption events

  • Failed to add device to policy group

  • Unfreeze code unmasked

To filter the timeline to only show action events, click .

An action event occurs when one of the following events occur:

  • A device action was run on the device.

    The timeline shows the type of action that occurred. A single device action may create multiple events. For example, when a Freeze request is created for the device, a Device freeze requested event is logged for the device. When the device is actually frozen, a Device frozen event is logged for the device. Each of these events appears separately on the timeline and may have different dates.

    The following types of action events are supported:

  • A rule was triggered for the device.

    The following events are supported:

    • Rule triggered on <rule name>
    • Rule triggered action hit the account threshold

    To view rule triggered events, your user needs to be assigned a role with View or Manage permissions for Rules. In addition, the following permissions are required:

Days with no events show as follows in the timeline:

  • No changes: no events were logged that day, but events were logged the day before and the day after
  • Offline: the device did not connect to the Absolute Monitoring Center that day, but it did connect the day before and the day after
  • No changes for <#> days: no events logged for two or more consecutive days
  • Offline for <#> days: the device did not connect to the Absolute Monitoring Center for two or more consecutive days
  • No events to show in this time range: no events logged during the selected date range

The events listed are current as of the Last updated date and time located at the bottom of the timeline. You can refresh the timeline to show the most recent events by clicking (Refresh the page). The timeline reloads events based on the currently selected date range and filter settings.

By default, the map shows the device's reported locations during the selected date range. When you click an event, the map focuses on the device's last known location before the event occurred.

For the map to be displayed on a device's History page, the Geolocation Tracking policy needs to be activated on the device.

Note that if the map is masked, the Device location privacy setting is enabled in Account setting. To view the device's current and historical locations when the map is masked, click View location, which triggers a Location history accessed event to be logged to Event History. The map remains visible for the selected device for the current user session.

Depending on the event you selected, and the technology used to locate the device, the map may show one or more of the following markers:

Marker Details
Locations based on GPS, Wi-Fi, or OS Location
The device's current location

The device's last known location before the selected event occurred

If the last known location was reported more than 7 days before the event, Device confirmed location <#> days before the event shows instead of the map.

A location that the device moved to during the specified date range

You may need to zoom out to see the device's complete location history for the date range. If the device has moved to and from the same location, the number of moves to the location shows in the marker.

Location history is not available for geofence related events.
Locations based on public IP address
The device's current IP location

The device's last known IP location before the selected event occurred

-or-

An IP location that the device moved to during the specified date range

You may need to zoom out to see the device's complete location history for the date range. If the device has moved to and from the same IP location, the number of moves to the location shows in the marker.

Location history is not available for geofence related events.

Each marker shows a tooltip containing the location, the date and time it was detected, and the geotechnology.

You can work with map in the following ways:

  • To zoom in, rotate the wheel button on your mouse upward, or double-click the map. Alternatively, click the + icon on the map.
  • To zoom out, rotate the wheel button on your mouse downward, or double right-click the map. Alternatively, click the - icon on the map.
  • To switch between map and satellite view, click and select Default or Satellite.
  • To view a full-screen version of the map, click .
  • To collapse the map, click . To expand it again, click .

For location updated events, you can also do the following:

  • To show connector lines between the displayed locations, click and select the Route checkbox.
  • To cycle through the device's location history, repeatedly click or on the map.

The AI-powered location summary helps you quickly understand a device's recent movement patterns, identify frequently visited locations, and detect potential location anomalies, such as false-positive moves.

Note that your device data is not used to train the AI model, nor is it shared externally or with other Absolute accounts.

To view an AI summary of location history for devices, your System Administrator needs to enable this feature in Settings > Account. If Location summary isn't visible above the timeline, the feature hasn't yet been enabled.

Depending on the Absolute product licenses associated with your account, this feature may not be available.

To enable AI summary of location history:

  1. Log in to the Secure Endpoint Console with the Manage permission for AI Assistant. Only System Administrators are granted this permission by default.
  2. On the navigation bar, click Settings > Account.
  3. Under AI-powered features, click the slider next to Location summary to set it to On.

To view an AI summary of a device's location history:

Above the timeline, click Location summary to open the summary pane. The summary generates on demand and organizes information under the following headings:

  • Device movement — Summarizes the device's primary and frequently visited cities and regions, how long it remained in each area, visit frequency, and detected travel patterns.

  • Low confidence — Identifies locations that may not represent actual device movement, such as erratic location jumps or conflicting network data, and explains why the locations were flagged.

The summary analyzes location updated events within the date range currently selected on the page, up to a maximum of 90 days. If you select a date range longer than 90 days (such as Last 1 year), the summary analyzes only the latest 90 days of the selected range, counting back from the device’s most recent location in that range. The summary title is updated to show the exact date range analyzed.

After the summary is generated, events that AI analysis identifies as low confidence are tagged with Low confidence on the timeline and in the event overview. These tags aren’t shown until you generate the summary, and they apply to the events within the selected date range (to a maximum of 90 days).

Each Absolute account can generate location summaries for a limited number of devices per day. Generating the summary again for the same device on the same day doesn't count toward this limit. The limit resets daily at 00:00 UTC. If your account reaches the limit, a message will tell you when you can try again, shown in your local time.

You can rate the summary's accuracy by clicking the thumbs up or thumbs down icon at the bottom of the summary pane. Your feedback is used to help improve the AI-powered location summary over time.

Click outside the summary pane to close it.

To view more information about an event, click anywhere in the event background. The event's overview opens to the right of the work area. The overview displays the type of event and the date the event occurred, and it may display a map. Rule triggered events show the rule that was triggered instead of the device name.

To collapse the map if it is displayed, click . To expand it again, click .

In addition to this information, the following information about each event type is available:

The overview area shows more information about the following event types:

The overview shows all location information available when the device's location changed.

If you don't have Address-level View permissions for Geolocation, the overview shows a warning that additional permissions are required.

Depending on the geolocation technologies available on a device, primary and supporting locations may be shown. For example, if Wi-Fi and OS Location are available for a Windows device, the Wi-Fi location is shown as the primary location and OS Location is secondary.

If a device changes its location by less than 100 meters, no event is logged.

Learn more about geolocation

The overview shows the following sections:

If no Public IP location updated events are shown on the timeline, ensure that the Show IP locations checkbox is selected.

The overview shows the following sections:

  • Map

    The device's current IP location is indicated on the map by a icon. Other IP locations detected during the selected date range are indicated by a icon. You may need to zoom out to see additional locations.

    See About the map.

  • Location

    This section shows:

    • The date and time when the IP location was detected on the device

    • The city, state/province, and country of the location. Street addresses are not available.

    • A note about location accuracy

  • IP address

    The public IP address The public IPv4 Internet Protocol address that identifies a device that is connected to the Internet. associated with the location

  • Internet service provider

    The Internet Service Provider (ISP) associated with the location

The overview shows the following sections:

  • Map

    The map updates to focus on the area covered by the geofence, for example a city or state. If it's a custom geofence, the boundaries are shown.

    The location of the device after it entered( or exited) the geofence is indicated by one of the following icons:

    • : Location was detected using GPS, Wi-Fi, or OS Location

    • : Location is based on the device's public IP address

      IP locations are only shown on the map when the Include IP locations option was selected in the location rule.

    See About the map.

  • Geofence name
  • Geofence description
  • Location technology
  • Device location
Depending on the device's operating system, power settings, activity type, and the method used to power off the device, some information may not be available.
Property Description
Default Gateway

The name of the device that passes traffic from the local subnet to devices on other subnets

The default gateway often connects a local network to the Internet, although internal gateways for local networks also exist.

This property applies to Windows and Mac devices only.
SSID

The identifier or network name that uniquely identifies the wireless local-area network (WLAN) that the device was connected to when the event occurred

The SSID column is empty if the device had no WLAN connection when the event occurred.

This property applies to Windows and Mac devices only, and Location services must be enabled on the device. For more information about enabling Location services, see Window or Mac documentation.
Local addresses The local Internet Protocol (IPv4 and IPv6, if available) address of the device when the event occurred
BSSID

The MAC address of the wireless local-area network (WLAN) that the device was connected to when the event occurred

The BSSID column is empty if the device had no WLAN connection when the event occurred.

This property applies to Windows and Mac devices only, and Location services must be enabled on the device. For more information about enabling Location services, see Window or Mac documentation.
Public addresses The public Internet Protocol (IPv4 and IPv6, if available) address of the device when the event occurred
Active Directory OU

The distinguished name of the Active Directory organizational unit that the device was associated with when the event occurred

The distinguished name is read from right to left and includes the full path to the object. For example:

CN=Mary Smith,OU=Employees,OU=Marketing,OU=Miami,OU=Sites,DC=ABC Company,DC=com

This property applies to Windows and Mac devices only.
Domain The name of the device's Windows domain, if applicable
User name The username associated with the activity

The overview shows:

If multiple device properties were updated at the same time, each change is shown in the overview.

Depending on the event, the overview may show:

For application compliance related events, click View policy to view the Application policy associated with the event.

The following information about the event shows:

  • The user that submitted the action request

  • The request ID
  • The action description (if provided)
  • A summary of the action event details, including:

    • For requests with an action status of Failed, the failure reason

    • (Freeze requests only) The unfreeze code associated with a Freeze request or Offline Freeze rule

      Your user role must be granted the Perform permission for Remove Freeze to view unfreeze codes.

    • (Theft reports only) The theft report status, the reason for the status, and the police report file name (if it was uploaded later)
    • (Run Playbook requests only) The Initiated by field, which indicates how the playbook was initiated on the device:

  • The configuration details that were used to create the action request

    If a View... link shows, click it to view the action's configuration details in a dialog

For completed Cryptographic Wipe, Firmware Wipe, and File Delete (Delete All Files) events, you can download the Certificate of Sanitization. For completed File Delete events, you can download the log file.

If your role is granted the correct permissions, you can click View Action to open the device action request on the Action Requests page of the History area.

If your role is granted the correct permissions, you can click Find this event on other devices to find related events on the Events page of the History area. When you click this button, the Events page opens filtered by the event type. By default, only the last seven days of events are displayed. Modify the Date filter to expand the results.

The following information about the event shows:

  • Rule status (Active or Inactive)

  • Date of the most recent rule update (as a relative date, such as 23 days ago)

    Hover over the relative date to view the exact date and time in a tooltip.

  • User that last updated the rule

  • Rule configurations:

    • Event that triggered the rule

      For Location rules, the specified locations and/or geofence names are listed. They are also shown on a map.

    • Action that the rule performs
    • Device groups that the rule is assigned to

    The event overview shows the current rule configuration.
    If the rule has changed since the event, it may no longer accurately describes the rule that triggered the event.
    If the rule has been deleted, or the device is no longer assigned to the rule, no rule information is available.

You can click Edit to edit the settings, activate or deactivate the rule, or delete the rule when it's no longer required.

You can search for events in the timeline using keywords.

To search the timeline:

Enter a keyword for the type of event you are searching for. You can use keywords from any of the supported event types. For example, to search for a change in the username, enter user name in the search field.

The timeline updates to show the events that match the search keywords within the specified date range.

By default, the date range is set Last 1 year. You can change the page's date range using either the timeline or the date range field.

To select a new predefined date range, click the date range field above the timeline and select one of the following options:

  • Last 7 days
  • Last 14 days
  • Last 30 days
  • Last 90 days
  • Last 1 year

The current date is always included in the date range. For example, if you select Last 14 days, the page shows location changes that occurred today and in the 13 days prior.

To specify a date range:

  1. Click the date range field above the timeline and click Select.
  2. Click the calendar picker to open it.

  3. Select a start and an end date in the calendars.

    To pick a month, click the month name at the top of the calendar and select the applicable month. Alternatively, you can use the and icons to navigate to it.

    To pick a year, click the year at the top of the calendar and select the applicable year. Alternatively, you can use the and icons to navigate to it.

The calendar picker closes and the selected dates show in the date range field.

You can export the device's events in CSV, Excel, or XML format. Separate reports are generated for location updated events, device usage events, and all other events. You can select a predefined date range or you can specify a custom date range.

If your user role isn't granted Address-level View permissions for Geolocation, the report that contains location updated events is not exported.

Depending on the total number of events included in your export, it may take a few minutes to export the report.

The exported reports include columns that show the following information:

Column Description
Identifier The unique Electronic Serial Number (ESN) assigned to the Secure Endpoint Agent that is installed on the device
Device name The name assigned to the device in the operating system
Serial number The identification number assigned to the device by the manufacturer
Login Username The name of the user that was logged in when the location was detected
Payload Created Timestamp The date and time when the payload of location information was created on the device for upload
Location Change (Yes/No) Indicates whether the device changed its location on a particular date
The following information about the last reported primary location:
Primary Technology The type of geolocation technology used
Latitude & Longitude The latitude and longitude of the device

Address

  • Street Address
  • City
  • State/Province
  • Country
 The address of the device
Accuracy The estimated accuracy of the technology used to locate the device in feet (or meters, depending on your user preferences)
The following information about the last reported IP location:
Latitude & Longitude (IP) The latitude and longitude of the IP location

Address

  • City (IP)
  • State/Province (IP)
  • Country (IP)
 The address of the IP location
Internet Service Provider The ISP associated with the IP location
The following information about the last reported secondary location, if available:
Supporting Technology The type of geolocation technology used
Latitude & Longitude (Supporting) The latitude and longitude of the secondary location

Address

  • City (Supporting)
  • State (Supporting)
  • Country (Supporting)
  • Street Address (Supporting)
 The address of the secondary location
The device's IP addresses:
Local IP The local IP addresses (IPv4 and IPv6) of each detected network adapter when the event occurred
Public IP The public IP address (IPv4) of the device when the event occurred
Public IPv6 The public IP address (IPv6) of the device when the event occurred
Column Description
Identifier The unique Electronic Serial Number (ESN) assigned to the Secure Endpoint Agent that is installed on a device
Device Name

The name assigned to the device in the operating system

This column applies to Windows and Mac devices only.
Date The date when the event occurred
Timestamp (Local Device Time) The time when the event occurred, expressed in the device's local time zone
Usage

Usage of the device presented in minutes of activity during a 24 hour period

A Windows or Mac device is deemed to be in use if it is unlocked. Activity ceases when the screensaver shows, the monitor is powered off, or the device is locked or shut down.

A Chromebook device is deemed to be in use if the display is active (not dimmed). Activity ceases when the display is dimmed, or the device is sleeping, locked, or shut down.

Activity The type of device usage event that occurred
BSSID

The MAC address of the wireless local-area network (WLAN) that the device was connected to when the event occurred

The BSSID column is empty if the device had no WLAN connection when the event occurred.

This column applies to Windows and Mac devices only, and Location services must be enabled on the device. For more information about enabling Location services, see Window or Mac documentation.
SSID

The identifier or network name that uniquely identifies the wireless local-area network (WLAN) that the device was connected to when the event occurred

The SSID column is empty if the device had no WLAN connection when the event occurred.

This column applies to Windows and Mac devices only, and Location services must be enabled on the device. For more information about enabling Location services, see Window or Mac documentation.
Local IP address The local Internet Protocol (IPv4) address of the device when the event occurred
Public IP address The public Internet Protocol (IPv4) address of the device when the event occurred
Local IPv6 address The local Internet Protocol (IPv6) address of the device when the event occurred, if available
Public IPv6 address The public Internet Protocol (IPv6) address of the device when the event occurred, if available
Active Directory OU

The distinguished name of the Active Directory organizational unit that the device was associated with when the event occurred

The distinguished name is read from right to left and includes the full path to the object. For example:

CN=Mary Smith,OU=Employees,OU=Marketing,OU=Miami,OU=Sites,DC=ABC Company,DC=com

This column applies to Windows and Mac devices only.
User name The username associated with the activity
Column Description
Date The date and time when the event occurred
Event

The event that occurred

If there are multiple property changes associated with an event, each change shows on a separate row in the exported report.
Actor

One of the following:

  • The username of the user who initiated the event
  • The device name of the device
  • The name of the rule (rule triggered events only)
Device/Object

One of the following:

  • The device name of the affected device
  • The name or identifier of the affected object
Secondary object The name or identifier of the object that was also affected by the event, such as the request ID of a Freeze request
Property name The field or property that was updated
Old value The previous value associated with the property
New value The new value associated with the property

To export the History page:

  1. Above the timeline, click Export to open the Export History dialog.

  2. Click the Format field and select one of the following options:

    3. Option Description
    CSV (.csv) with column names Exports the report (including column headers) in Comma Separated Values (.csv) file format
    CSV (.csv) without column names Exports the report (excluding column headers) in Comma Separated Values (.csv) file format
    Excel (.xlsx)

    Exports the report (including column headers) in Microsoft Excel Open XML Spreadsheet (.xlsx) file format

    If you select the Excel option when the report contains more than 1 million rows, the system automatically exports the file in CSV file format. Reports of this size are not supported in Excel.
    XML (.xml) Exports the report in Extensible Markup Language (.xml) file format

  3. Click the Date range field and select one of the following options:

    • Last 7 days
    • Last 14 days
    • Last 30 days
    • Last 90 days
    • Last 1 year
    • Select

    If you clicked Select:

    1. Click the calendar picker to open it.

    2. Select a start and an end date in the calendars. You can select any end date in the past that is up to 365 days from the start date.

      To pick a month, click the month name at the top of the calendar and select the applicable month. Alternatively, you can use the and icons to navigate to it.

      To pick a year, click the year at the top of the calendar and select the applicable year. Alternatively, you can use the and icons to navigate to it.

    The calendar picker closes and the selected dates show in the date range field.

  4. By default, all dates and times in the report are presented in the time zone set in your user profile. To present them in another time zone, click the Exported time zone field and do one of the following:

    • To apply a new time zone to this report export only, search for a city in the desired time zone and select it.

    • To apply a new time zone to this report export, and set it as the default value to show in the Time Zone field for all future scheduled and exported reports:

      1. Search for a city in the desired time zone.
      2. Hover over the city name and click Set default.

    The time zone under the field is updated to your selection.

    To set it back to the time zone set in your user profile, select Use my time zone.

    This setting is user specific; it does not update the Exported time zone field for other users. The report for device usage events always presents dates and times in the device's local time zone, regardless of this setting.

  5. Under Options, review the event types included in the export and clear the checkbox of an events you want to exclude. A separate report is generated for each selected option.

  6. If you left Export location events selected, clear the Include minor moves and IP location checkbox if you want to exclude the following location changes from the export:

    • Wi-Fi location changes of less than 100 meters (328 feet)
    • IP locations that do not represent actual movements of the device

  7. Click Export.

    The export process starts. Depending on the size of the report, it can take a few minutes to download.

    If you exported a report in error, you can cancel the export if it hasn't finished processing. To do so, click in the export processing dialog. The report export is canceled.

  8. Open the downloaded reports. If the reports don't download automatically, follow the on-screen instructions that apply to the browser and operating system to save the reports to a location on your computer.

    1. Navigate to the directory that you saved the report. By default, the file names include the report name, the device name, and the date and time of the export, in the following formats:

      • Event_History_<device name>_yyyy-mm-dd-hh-mm(<time zone>).<file extension>
      • Location_History_<device name>_yyyy-mm-dd-hh-mm(<time zone>).<file extension>
      • Device_Usage_History_<device name>_yyyy-mm-dd-hh-mm(<time zone>).<file extension>

      Depending on your operating system and browser, if the report names includes special characters, the special characters may be removed from the file names or replaced by underscore (_).

    2. Open and review the reports using software that supports the reports' file formats. For example, you can use a spreadsheet application, such as Microsoft Office Excel or OpenOffice Calc, to view a XLXS file.

      If you exported an XML formatted report that contains a very large amount of data, we recommend using Notepad++ to view its contents.