Report all user activity in LEM by username

Hi Stephen--

Hopefully I am understanding your request correctly - are you asking for some kind of audit trail? 

Thanks,
DH

DH,

Yeah, pretty much.

Thanx

Stephen

Hi, Stephen.

Your best bet is to run an nDepth query for the user in the Console, and then export the results in either PDF or CSV format. See the following KB for more information:

Export nDepth results in custom or text formats for retention and ad hoc reporting

LEM/TriGeo Reports is set up to present reports by event type, not user; so if you wanted to do this solely by using Reports, you'd have to run and filter several reports to get what you need.

Let me know if the nDepth option won't work for you.

Thanks.

Thanx, Phil, but I'm new at this. I've tried accessing "Auditable Events (All)", "UserLogon.SourceLogonID" & "UserLogon.DestinationLogonID", using wildcards around the username, and nothing comes up.

Any ideas?

What's your specific goal? If it's just to see everything related to a specific user, try this:

1. Open the LEM/SIM Console, and then log in as an administrator.
2. Click the Explore, and then select nDepth. This should show you all of your alerts for the past 10 minutes.
3. In the Refine Fields list on the left, find the user you're interested under User Name. If the user is not there, expand your search time frame.
4. Drag the username into the search bar.
5. Click Search (blue "play" button).
6. Expand the time frame of the search as necessary.
7. Follow the steps in the KB linked above to export the results.

Let me know if this doesn't meet your needs or if you have any questions.

Thanks.

We're making progress - thanx. However, it lists me out 100 usernames, and the one I'm looking for isn't there. Dragging a different username & trying to modify it doesn't work. How do I get it to list all the usernames, or just the one I want? BTW, I don't have the exact username, just part of it - I was going to use wildcards for the search.

Update - actually when I dragged one up, it did so in a way for which I could not update the username in the condition. I just dragged a different username up, & it looks like any other condition now (i.e., I can edit it). I must have done something different. Please stand by ...

Hm - I have <blue_filter_icon> User Name = <pencil_icon> *kenneer*, but when I get the blue arrow back I still have 100 usernames. ??????

That's odd. Two things to try:

1. Check Result Details (second icon from the right on the bottom toolbar), and see what's highlighted in those alerts. Only the values you searched for should be highlighted.
2. Modify the search so you're not using a leading wildcard character in the search value (pencil icon). nDepth doesn't do well with leading wildcard characters -- that's why the field (should have) turned yellow when you entered one.

OK - this is getting weird, or should I say stupid. I used kenneer without wildcards, and, no surprise, it said no matches. The weird thing is the username count is still 100.

Phil,

Well, there are over 333,000 pages of results, and the one I did check had no highlighted entries.

Anything else I can try?

Thanx

Stephen