Configuring auditing

Enterprise Vault auditing records data in a number of different categories. You can specify whether auditing is enabled or disabled for each category. All categories can record summary audit data, but some can also record detailed data.

To configure auditing

  1. In the Administration Console, expand the tree in the left pane until the Enterprise Vault Servers container is visible.

  2. Click the Enterprise Vault Servers container.

  3. Right-click the computer whose auditing you want to enable or disable and then, on the context menu, click Properties.

  4. Click the Auditing tab.

  5. If you want to enable or disable all auditing, check or uncheck Audit entries based on the following categories. Otherwise, check or uncheck the required audit categories.

    View

    Records details of viewing archived items, either as HTML or in their original formats.

    Delete

    Records details of archived items being manually deleted. Enterprise Vault does not audit deletions that result from expiry.

    Restore

    Records details of archived items being restored.

    Archive

    Records details of items being archived, either manually or on a scheduled run.

    PST Migration

    Records details of items being migrated from PST files.

    NSF Migration

    Records details of items being migrated from NSF files.

    Admin Activity

    Records details of configuration changes made in the Administration Console, such as adding a new service, creating archives, or enabling mailboxes.

    Advanced Search

    Records details of searches performed using Outlook or the Web Access application, including the terms used and the number of items found.

    Get Online XML

    Records details of document retrieval into SharePoint Portal Server.

    Saveset Status

    (For support use only.) Records whether a saveset file is available.

    SPS Archive

    Records details of items being archived from within SharePoint Portal Server.

    User

    Records details of your own auditing entries, which you can add by calling a COM object that is served from the Admin Service. See below for VBS and ASP examples of how to do this.

    View Attachments

    Records details of viewing archived items from within SharePoint Portal Server.

    FS Archive

    Records details of storage events from File System Archiving.

    Domino Archive

    Any Domino archiving activity.

    Domino Restore

    Any Domino restore activity.

    Exchange Synchronization

    Records details of creation, modification, and deletion of Exchange managed content settings. Enterprise Vault records relevant details when it is configured to archive from Exchange managed folders and to synchronize with their managed content settings.

    Archive Folder Updates

    Records the saveset ID and source and destination folders of archived items being moved to a different mailbox folder.

    Retention Category Updates

    Records details of changes to the retention category of archived items.

  6. Click OK to save the changes you have made.

  7. Restart the Enterprise Vault services on the computer.