NAC Audit Events log files
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎10-18-2016 02:10 PM
Are older NAC Audit Logs stored?
4 REPLIES 4
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎10-18-2016 03:14 PM
Hello,
If you don't find what you need in the tamAudit log files you may want to check the tam.log files.
These should be rotated similar to the tamAudit.logs and will show you who deleted what, when:
Example of a deletion event:
15558 1476810563726 End-System.6.Event root DESKTOP-B9SK4TI --- Remove End-Systems and Events Removed End-System for MAC: A4:77:33:33:2C:A0
Unfortunately the time is in time ticks, but if you open the log file using NetSight Console log viewer then it should covert to a readable time.
Thanks
-Ryan
If you don't find what you need in the tamAudit log files you may want to check the tam.log files.
These should be rotated similar to the tamAudit.logs and will show you who deleted what, when:
Example of a deletion event:
15558 1476810563726 End-System.6.Event root DESKTOP-B9SK4TI --- Remove End-Systems and Events Removed End-System for MAC: A4:77:33:33:2C:A0
Unfortunately the time is in time ticks, but if you open the log file using NetSight Console log viewer then it should covert to a readable time.
Thanks
-Ryan
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎10-18-2016 03:14 PM
Awesome. Looks like they only rotate once a week so I was missing them as some off the other ones rotate more often.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎10-18-2016 03:02 PM
Should be on the netsight server in Netsight/appdata/logs tamAudit.log or date_tamAudit.log
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
‎10-18-2016 02:14 PM
Sorry, I thought it would ask me for more detail before posting. I'm trying to track down when some devices were deleted from out NAC. I can see the data in the NAC Audit Events tab but it only goes back to today. Are there older log rotations stored for this log? it appears to be the tamAudit.log file. If not is there a way to set this up to keep more then today's logs?
