Managing Audit Files

Individual audit records can be viewed in the live audit viewer, and filtered and exported using the OneSpan Authentication Server Appliance Configuration Tool.

Events generated by the OneSpan Authentication Server component for auditing are stored in the internal database. They are moved to an audit database on a monthly basis or until a maximum audit data size limit of 500 MB is reached. When this limit is exceeded, new audit data is stored in a new database part.

Parts of the database can be downloaded and deleted via the OneSpan Authentication Server Appliance Configuration Tool. Downloading is the same as the exporting, but uses a format compatible with OneSpan Authentication Server.

Figure:  Live Audit Viewer

Viewing audit files

To view and filter audit files

1. Launch the OneSpan Authentication Server Appliance Configuration Tool and enter your credentials (see  Accessing OneSpan Authentication Server Appliance Configuration Tool and OneSpan Authentication Server Administration Web Interface).
2. Navigate to Monitoring > Audit Logs.

3. If required, you can filter by using simple or advanced filters:.

   • To use the simple filter, type the characters to be searched for in the message part of the audit message in the Filter box. Only lines with content that matches the filter entry will be listed. To clear the filter, click X.

   • To use the advanced filter, click the arrow to the right of the Filter box to open the Advanced Filter dialog (see Figure: Advanced audit filter fields). For more information about searching using the filter fields, see Table: Audit filter fields.

     

     Figure: Using the advanced filter

     

     Figure:  Advanced audit filter fields

It is only possible to access the advanced filter when the simple filter is cleared. To clear the simple filter, click the X icon next to the Filter box.

Exporting and downloading auditing information

Exporting auditing information can be useful in the following cases:

• One reporting system is used for all servers on a network.
• Auditing information needs to be kept for a long time.

You can use filters to define which data should be exported.

To export audit files

1. Launch the OneSpan Authentication Server Appliance Configuration Tool and enter your credentials (see  Accessing OneSpan Authentication Server Appliance Configuration Tool and OneSpan Authentication Server Administration Web Interface).
2. Navigate to Monitoring > Audit Logs.
3. Click Export. The Export Log dialog opens (see Figure: Exporting audit files). Fields are explained in Table: Audit export fields.

Figure:  Exporting audit files

Although it is still called CSV format, the CSV option creates an export file that uses tab characters as the separator, not a comma!

To download audit files

1. Launch the OneSpan Authentication Server Appliance Configuration Tool and enter your credentials (see  Accessing OneSpan Authentication Server Appliance Configuration Tool and OneSpan Authentication Server Administration Web Interface).
2. Navigate to Monitoring > Log File Management and click Databases. Available audit files will be listed below.

3. Click the download icon to the right of an available audit file to download it.

   

   Figure:  Downloading audit files

   Downloading audit data is the same as exporting and uses the OneSpan Authentication Server–compatible format.

   It is not possible to remove database partitions manually. However, you can set up log files to be deleted automatically.

To configure automatic deletion of audit files

1. Launch the OneSpan Authentication Server Appliance Configuration Tool and enter your credentials (see  Accessing OneSpan Authentication Server Appliance Configuration Tool and OneSpan Authentication Server Administration Web Interface).
2. Navigate to Settings > Logging and Auditing.
3. Select Delete audit logs and specify how long you want to keep audit logs.