Open topic with navigation

# Audit Logs

Your system’s audit logs are available for viewing. Audit logs, as Common Event Format (CEF) audit events, can be sent to ArcSight ESM directly for analysis and correlation. For information about forwarding audit events, see Configuring Audit Forwarding to a Specific Destination.

Note: Audit logs are retained permanently by .

To view audit logs:

1. Click Administration > System Admin.

2. Click Audit Logs in the Logs section.

3. Select the date and time range for which you want to obtain the log.

4. (Optional) To refine the audit log search, specify a string in the Description field and a user name in the User field. When a string is specified, only logs whose Description field contains the string are displayed. Similarly, when a user is specified, only logs whose User field contains the username are displayed.

5. Click Search.