AuditAudit

All actions performed by users are systematically logged in Pure. Creating, retrieving, changing, deleting, viewing or reporting on content is logged as well as any other functionality used.

Content that was changed due to running Jobs in Pure is also logged. This is usually as the user ‘root’, though with each release more jobs use the name of the job to indicate in which context the content was changed. 

The content that was changed, including its state before and after the change, are also logged in addition to the operation, the user and the time and date. For example, if a project title is changed the log will show the title before and after the change operation was carried out.

Data synchronized from external sources (such as HR details on Person records, citations or Impact Factors etc.) are logged with a source ID and import date as well as the common audit information.

Through these processes the entire history of each individual data item in Pure is systematically logged, securely stored, and made available for system administrators and other users with special privileges.

This is very useful when troubleshooting an issue it is often relevant to know how something was created/changed/deleted. What might have been changed or deleted. Or maybe you want to know why or when it was created/changed/deleted. Maybe you need to compare content before or after a change.

Another thing you might need details on are whom logged into Pure and when. Or maybe you want to investigate failed login attempts.

Pure Administrators can view the audit log using the search and filter functionality on the Administrator > System information > Audit.

If you are at a listed record you can also access the audit log by clicking the gear icon on a record in the content list view and selecting Show audits

 

Search the audit log

To search the audit logs, fill in any of the following fields from the table below to restrict your search to records that match this query and press Search afterwards.

Field	Description
Username	Show all actions of a specific user. Enter the username. For Pure 5.32.0 search supports wildcards: It supports wildcards * and ?. A * will match multiple characters, a ? will match exactly one character. E.g. “user?ame” will match “username”, but also “userfame”. “user*ame” will match “usernnnnnname”. If no wildcard is used, it first tries to find exact matches. If it finds no exact matches, it goes to wildcard mode and repeats the search. If a wildcard is used, it performs the search in wildcard mode. Any wildcard search will have an implicit * at the beginning and end of the word. E.g. “ernam” will match “username”, as if the query was really “*ernam*”.
Content-ID	Show all actions on a specific record (e.g. actions on an Application record). This is the Pure ID for a record, which can be found in the top-left corner of the record's editor window.
Starte date	Show actions after a specific date.
End date	Show actions before a specific date.
Operation	Show only this chosen operation (e.g. create, delete). You can use a wildcard search, with * replacing multiple characters and ? replacing a single character, i.e “auth*” will give you any authentication operations.   See table “List of Audit operations” for full list.

Inspecting audit log search results

You can view an audit log to see what happened to a certain record, or what actions were performed by a certain user.

Results that match your query are displayed. You can:

• Choose how many results to display on the page by hovering on the results dropdown.
• Show the log entry in XML format, by expanding the XML area.

• Show the XML in a formatted way using the Audit XML formatted link for each result, where available.

Key things to identify in the XML is often:

• Before and after values
  • Found in the XML
• User responsible for the modification and the time of the modification
  • Found in the XML metadata on top of the XML