Data360 Analyze: How to get audit information to help monitor user activity

The following log files will tell you who is logged in, and what time they logged in at. Note: These log files will not state what time the users logged out at. The session simply times out hours later.

lae-audit.log[.<DATE>] 

This log records interactions with the web server and allows you to see who is logged in and at what time they accessed the system"

The entries will be similar to this, where `ccos` is the username:

{"timestamp":"2020-01-08T15:54:35.721Z","auditCode":"authenticationSuccess","userId":"_system_","username":"system","tenantName":"defaultTenant","success":true,"arguments":{"remoteHost":"0:0:0:0:0:0:0:1","username":"ccos"},"response":"ccos"}

lae-webapp.log[.<DATE>]       

This log records interactions with the web server and allows you to see who is logged in and at what time they logged in at:

2020-01-08 15:54:36 INFO AccessLog:201 - {"timestamp":"2020-01-08T15:54:36.625Z","requestId":753,"code":"lae.security.audit.web.servlet.filter.servletResponse","username":"ccos"

To find the log file locations, please see this article: Log File Location in Data360 Analyze and see the section titled LOG FILE LOCATION FOR COMMON LOGS

The attached data flow will allow you to bring log files in to Data360 Analyze and parse them. It can be altered to return the results of the audit and webapp logs.