locked
Where are my Audit Logs RRS feed

  • Question

  • Hello, 

    I think i got the Audit Collection service working.

    Where do I see the Audit Logs from my Managed Agents?

    I looked in my Operations Manger Console: Monitoring - Microsoft Audit Collection Services - *

    Where do I see the Logs?

    Where are the logs Stored in the Database - in Which Table I do see the following tables: in Server\OPSMGRAC - Databases - OperationsManager - Tables:

    dbo.dtCategory

    dbo.dtConfig

    dbo.dtMachine

    dbo.dtPartition

    dbo.dtSource

    dbo.dtType

    Thanks for reply.

    dbo.
    dbo.
    dbo.d
    Thursday, January 15, 2015 3:17 PM

Answers

All replies

  • Hi,

    The ACS database is the central repository for events that are generated by an audit policy within an ACS deployment.

    There is a table named dbo.dtevent_**, you may find audit events there.

    In addition, please also refer to the links below for more details about ACS:

    Collecting Security Events Using Audit Collection Services in Operations Manager

    http://technet.microsoft.com/en-us/library/hh212908.aspx

    How to Deploy Audit Collection Services (ACS) in SCOM 2012

    http://blogs.technet.com/b/fesiro/archive/2013/01/08/how-to-deploy-audit-collection-services-acs-in-scom-2012.aspx

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    • Proposed as answer by Yan Li_ Monday, January 26, 2015 6:54 AM
    • Marked as answer by Yan Li_ Tuesday, February 3, 2015 1:31 AM
    Friday, January 16, 2015 4:12 AM
  • Hi,

    The ACS database is the central repository for events that are generated by an audit policy within an ACS deployment.

    There is a table named dbo.dtevent_**, you may find audit events there.

    In addition, please also refer to the links below for more details about ACS:

    Collecting Security Events Using Audit Collection Services in Operations Manager

    http://technet.microsoft.com/en-us/library/hh212908.aspx

    How to Deploy Audit Collection Services (ACS) in SCOM 2012

    http://blogs.technet.com/b/fesiro/archive/2013/01/08/how-to-deploy-audit-collection-services-acs-in-scom-2012.aspx

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    thanks for reply.

    are the logs also shown in the operations Manager?

    Tuesday, January 20, 2015 11:56 AM
  • The logs should be under the database named OperationsManagerAC on your SCOM DB server.

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    Wednesday, January 21, 2015 2:20 AM
  • The logs should be under the database named OperationsManagerAC on your SCOM DB server.

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    this means i won't be able to see the logs within operations Manager? - I have to get on my SCOM DB server and look for this Table?
    Monday, January 26, 2015 12:44 PM
  • You may deploy Audit reporting, then with operation manager, under reporting console, we can run audit report, More details please refer to the link below:

    How to Deploy Audit Collection Services (ACS) in SCOM 2012

    http://blogs.technet.com/b/fesiro/archive/2013/01/08/how-to-deploy-audit-collection-services-acs-in-scom-2012.aspx

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    Tuesday, January 27, 2015 1:39 AM