It is possible to do reports directly on the audit trail - i.e. on the list kept by the system of all the action that have been done by all the users.

The search conditions on the audit trail are specified using the special object type name '_audit'. The attributes that are available for the search conditions are:

•Action: a code identifying the action that was performed

•UserId: the database id of the user that performed the action

•ObjectId: the database id of the object that was acted on - this applies only to crtain kind of actions like creation or modification of objects

•Time: the date-time of the action

ObjectId and UserId are references to objects, and so they can be used as the root of more complex search path - e.g. _audit.UserId.name specifies a search on the name of the user that performed the actions.

The action codes are as follows:

•Login = 0: user log-in

•Logout = 1: User log-out

•Create = 2: Creation of a new object.

•Update = 3: Modification of an existing object.

•Spike = 4: Delete of an object.

•Unspike = 5: Undelete of an object.

•AutoUpdate = 6: Automatic update of an object triggered by the modification of another object that influences the value of automatic computed attributes.

•Startup = 7: Server startup.

•Shutdown = 8: Server shutdown.

•PartitionReset = 9: Forced re-computation of the object count and size(s) of a partition. The associated object is the partition.

•CopyTo = 10: Object copied to another object (new or existing).

•Publish = 11: Publishing of an object.

•Unpublish = 12: Un-publishing of an object.

•Search = 13: Search.

•Load = 14: Object load.

•CheckOut = 15: Object check-out.

•UncheckOut = 16: Object undo check-out (check-in).

•IncGlobalCounter = 17: Increment of a global (non object-specific) counter.

•IncCounter = 18: Increment of a counter.

•SpikeUpdate = 19: Update of an object triggered by a delete operation of an object referenced by this one or by an undelete operation of the object that references non-existing other objects.

•Read = 20: The object has been read by the user.

•Print = 21: The object has been printed by the user.

The XML returned by a search on the audit trail has the same structure of the XML returned by the 'do.ashx?cmd=auditnav' command - see http://forum.teradp.com/topic.asp?whichpage=1&TOPIC_ID=239#3181.

Here is an example of audit trail search condition that searches by action, user id, user name, user group name, object id and action date-time (all set using optional parameters):

  <Conditions xmlns="http://www.teradp.com/schemas/GN4/1/SearchConditions.xsd" ObjectTypeName="_audit">

    <SearchNode xsi:type="SearchConditionList">

      <List xsi:type="SearchCondition" Path="[_audit.Action]" Op="In">

        <Ids xsi:type="VariableSearchNode" Name="actionIds" Type="IdList" Optional="true" />

      </List>

      <List xsi:type="SearchCondition" Path="[_audit.UserId]" Op="In">

        <Ids xsi:type="VariableSearchNode" Name="userIds" Type="IdList" Optional="true" />

      </List>

      <List xsi:type="SearchCondition" Path="[_audit.UserId.name]" Op="Containing">

        <From xsi:type="VariableSearchNode" Name="userName" Type="String" Optional="true" />

      </List>

      <List xsi:type="SearchCondition" Path="[_audit.UserId.groups.name]" Op="Containing">

        <From xsi:type="VariableSearchNode" Name="groupName" Type="String" Optional="true" />

      </List>

      <List xsi:type="SearchCondition" Path="[_audit.ObjectId]" Op="In">

        <Ids xsi:type="VariableSearchNode" Name="objectIds" Type="IdList" Optional="true" />

      </List>

      <List xsi:type="SearchCondition" Path="[_audit.Time]" Op="Between">

        <From xsi:type="VariableSearchNode" Name="from" Type="DateTime" Optional="true" />

        <To xsi:type="VariableSearchNode" Name="to" Type="DateTime" Optional="true" />

      </List>

    </SearchNode>

  </Conditions>

report_Audit.xml is the complete report options file using these search conditions:

Some example of its use:

srv4 report -opt report_Audit.xml -pars from:2011-08-01T00:00:00;to:2011-09-01T00:00:00 -out c:\temp\out.xml

creates a report of ALL the action performed in the month of August 2011.

  srv4 report -opt report_Audit.xml -pars actionIds:2,3;groupName:editors -out c:\temp\out.xml

creates a report of all object creation and modification done by user in the 'editors' group (more precisely: in any group whose name contains 'editors').

  srv4 report -opt ..\test\report_Audit.xml -pars userName:marco -out c:\temp\out.xml

creates a report of all the actions performed by users whose name contain 'marco'.