Hi

I was looking for some assistance regarding auditing FSA events such as "search", and "view" for file system archiving. We are using Enterprise Vault v8 with SP2. The database and auditing has successfully configured. I am viewing the data using the Symantec Auditviewer.exe utility. Can anyone confirm what all the non obvious audit titles mean. ie achive, object id.   I have enclosed a screenshot with details.

From the information we can see what key words are being used for searches and by who, however it doesnt seems easy to identify files viewed and in what directory.

Can anyone give any other recommendation ( preferably with documentation) on any other methods to access this information. I know the data is stored in SQL however short of doing basic queries, its not much more helpfull.

Any help would really be appreciated.

Thanks

Nick Thompson