Downloading audit log

You can download an audit log from the Data Resiliency Service dashboard to help you examine errors and resolve problems in the system.

Procedure

To download the audit logs, complete the following steps:

  1. On the Data Resiliency Service dashboard, click the audit log icon Audit log icon.
    This action opens the Download audit log pop-up window where retention period and the date since the audit log is available are shown.
  2. In the Start date field, click a start date in the calender widget.
    Days in black color are enabled and can be selected whereas days in gray color are disabled and cannot be part of the audit log.
  3. The default setting of End date is set to the current date.
  4. Click either Download.json or Download.zip.
    The audit log file gets downloaded in <timestamp>-audit-logs.json format to the default download location of your browser.

What to do next

You can use an editor for the JSON to read the audit log. Alternatively, a scripting language can also be used to read the audit log and extract important information in the comma separated value (CSV) format. Refer to the following basic example in Python to understand the structure of the audit log.

import json
from datetime import datetime

inputFileName  = '1738068802-audit-logs.json'
outputFileName = datetime.now().strftime('%Y%m%d-%H%M%S') \
   + '-defender-audit-log.csv'
numberOfLogs   = 0

# load the .json file from local directory

with open(inputFileName, 'r') as file:
   auditLog = json.load(file)

# print first audit log entry completely to get a .json format sample

print('=== Auditlog message sample ===\n')
formatedAuditLog = json.dumps(auditLog[0], indent=3)
print(formatedAuditLog)

# print formated content of all audit log entries in CSV format

csvOutputFile = open(outputFileName, 'a')
for logEntry in auditLog:
   numberOfLogs +=1
   csvOutputFile.write(logEntry['timestamp']    + ';' + 
                       logEntry['severity']     + ';' + 
                       logEntry['messageClass'] + ';' + 
                       logEntry['messageId']    + ';' +
                       logEntry['message']      + '\n')
csvOutputFile.close()
print('\n=== CSV output file: ' + outputFileName)
print('=== Number of messages: ' + str(numberOfLogs))