Audit data can be viewed through the Endpoint Management Console Dashboard. To access this page, click the Dashboard link in the left pane of Endpoint Management Console. From this page you can see a zone-wide view of the audit events that have been logged into the system. You can see key indicators about top events and impacted objects, and drill into the Events (Audit Log) view in a filtered manner. By default, the Dashboard displays an overview of events in the last 4 hours. If you want to view more data, you can choose alternative schedules.
When you log in to Endpoint Management Console and click Dashboard, the following information is displayed:
Top 5 Events: The top 5 events generated by Endpoint Management Console administrators or managed devices, based on the event count. This list is not based on the classification type. Click the event name hyperlink to view the event details.
Top 5 Critical Events: The top 5 events generated by Endpoint Management Console administrators or managed devices. This list is based on the maximum count for a particular event, with the classification type as Critical. Click the event name hyperlink to view the event details.
Top 5 Major Events: The top 5 events generated by Endpoint Management Console administrators or managed devices. This list is based on the maximum count for a particular event, with the classification type as Major. Click the event name hyperlink to view the event details.
Top 5 Change Events by Administrator: The top 5 events generated by a Endpoint Management administrator. This list is based on the maximum number of events generated by an administrator. Click the event name hyperlink to view the event details.
Top 5 Critical Events by User: The top 5 events generated by users who have logged in to managed devices. This list is based on the maximum count for a particular event, generated by a managed device. Click the event name hyperlink to view the event details.
Top 10 Informational Events: The top 10 events generated by Endpoint Management administrators, or managed devices. This list is based on the maximum count for a particular event, with the classification type as Informational. Click the event name hyperlink to view the event details.
Top 10 Devices: The top 10 devices in the zone that are generating the maximum number of events. Click the device name hyperlink to view device details in the Audit Log panel.
Top 10 Referred Devices: The top 10 devices in the zone on which the maximum events have occurred. The device might or might not be a target, but the actual target objects reside on this device. For example, a Primary Server on which a large number of bundles have been created can be a referred device. This is because although the target of change is the bundles, the events have occurred on the Primary Server.