Q: The default columns for each event type look different in this new version of Audit Trail. Where can I find the columns from the previous version of Audit Trail?

To make Audit Trail reports more consistent, some of the columns have been reorganized into groups. Previously, all columns were displayed as a flat list. Now they are arranged into multiple tiers. For example, all user related properties are now organized as sub-columns under User and all entry related properties are located under Resource as sub-columns. You can directly click the compound columns to view the sub-column details. You can still select any of those sub-columns to view as top columns in the report by using the Configure Column Display dialog box.

Q: Are there additional filters other than the filters in the left pane?

Click the funnel icons on each column header to add advanced filters. The filter criteria will be displayed above the report grid.

Q: Can I see additional details on changes listed in the Changes column?

Click on the change listed in the Changes column to view a dialog box of changes related to the audit event. The first line is the object name or ID affected by the changes, for example, a metadata field name and its field ID. The contents below the first line are divided into groups, each of which contains the name of the changed property, the value before change, and the value after change. For example, the property name could be Field Type, the before value could be number, and the after value could be string.

Q: Can I re-index the search catalog manually?

Yes, you can re-index a search catalog by removing and re-adding the date ranges.

For previous installations (before Update 4), perform the following steps to re-index the search catalog:

1. Locate the search catalog location by viewing the Search Engine tab in the Audit Trail Configuration page.
2. Detach the search catalog by clicking the Detach button.
3. Delete the catalog folder from step 1.
4. Click the Attach button to select the same folder name (or specify another path) on the Search Engine configuration page to create a new catalog.

Q: Can Audit Trail 11 reuse reporting data from an Audit Trail 10 SQL database?

No. Audit Trail 11 will only migrate the data from archived audit logs. It will not migrate reporting data from an Audit Trail 10 reporting SQL database. However, it will migrate saved report definitions.

Q: What should I do if an audit event I'm expecting is not included in a report?

1. If the audit events are not managed by the Laserfiche Server, ensure the respective audit log files are in folders listed in the Repositories tab on the Audit Trail Configuration page.
2. Ensure the audit events are within the date ranges in the Search Catalogs tab on the Audit Trail Configuration page.
3. Re-index audit catalogs for all date ranges that include the audit events.

For previous installations (before Update 4):

1. If the audit events are not managed by the Laserfiche Server, ensure the respective audit log files are in folders listed in the Repositories tab on the Audit Trail Configuration page.
2. Ensure the audit events are within the data age in the Search Engine tab.
3. Re-index audit catalogs of the repository. See above for how to re-index.

Q: Previously, I could directly access the audit reporting SQL database to run my own queries and generate my own audit reports or charts as an automatic scheduled task. Can I directly read the search catalog?

Audit Trail 11 uses the Laserfiche Full Text Search Engine (LFFTS) to index the audit data in order to provide a better report generation experience. As the search catalog schema is undocumented and subject to change, Audit Trail 11 includes a small toolkit (PowerShell script) to export reports as Microsoft Excel files. Use Windows scheduled tasks to create an automated task that runs the script. By default, the Excel file is a TAB-delimited CSV format file. By default, the script is located in the Samples subfolder of your Audit Trail installation folder:

C:\Program Files\Laserfiche\Audit Trail\Samples\Export-AuditReport.ps1

The basic workflow should be:

1. On the Audit Trail Reporting page, design a report by applying filters as desired.
2. Use the Configure Column Display dialog box to select the columns to include in the report.
3. Save the report and note the report ID visible from the browser address bar:

   https://ServerName/AuditTrail/reports/ABCD1234EFGH-IJKLM?lang=en&dataSource=repositoryandserver&view=table

4. Open the Task Scheduler on Windows to create a scheduled task
5. Use this task to run the PowerShell script with the following parameters

   Export-AuditReport.ps1 -Repository "repositoryname(servername)" -ReportId "ABCD1234EFGH-IJKLM" -ExportFile "reportfilename.xlsx"

   By default, the exported report file will be located in C:\ProgramData\Laserfiche\AuditAnalytics\Export.

Use the exported XLSX file to generate your own reports/charts, send email, or import the file into another database or business intelligence tool for further data processing.

Q: Are there export time benchmarks when using the PowerShell script to export data?

Export time depends on the number of columns and the number of events exported. You can roughly calculate the total export time using the following formula:

(Export time in seconds)=(number of events in millions)*columns*12

For example, exporting 0.5 million events with 20 columns will take roughly 2 minutes.

Q: What should I do when Audit Trail cannot draw charts because of an invalid SSL certificate?

You may see the following message when trying to view charts in the Audit Trail Reporting site.

"The SSL/TLS certificate is required before using the charts component." or "Failed to connect to Laserfiche Audit Trail Charts Component."

These errors can occur if you bypass the "choose SSL/TLS certificate" step during the installation process or select an invalid SSL/TLS certificate (weak signature algorithm and so on).

If you bypassed this step during the installation, bind a valid certificate to the IIS site hosting Audit Trail and modify the necessary configuration files as follows:

1. Edit IIS Site Bindings:
   1. Open Internet Information Services (IIS) Manager
   2. Select the site hosting Audit Trail reporting. By default, Audit Trail is installed under Default Web Site.
   3. In the Actions pane, under Edit Site, click Bindings.
   4. If there is no https blinding, add one, set the port number 443 and choose an SSL certificate.
   5. Use a web browser to view https://FQDNtoYourAuditTrailHost/ and make sure there is no error like NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM
2. Stop the following Windows services:
   • LfAnalyticsEngine (display name is Laserfiche Analytics Engine Service)
   • LfChartSVGService (display name is Laserfiche Analytics Engine Chart SVG Service)
3. Restart the AnalyticsEngineAppPool application pool or restart IIS.
4. Back up %Install folder%/Analytics Engine/ReportingSite/web.config, (default install folder is %programFiles%/Laserfiche) replace All "https://ExampleInvalidDomain/ReportingService" to "https://YourAuditTrailHostFQDN/ReportingService"
5. Backup %Install folder%/Analytics Engine/ReportingService/Laserfiche.AnalyticsEngine.Host.exe.config, (default install folder is %programFiles%/Laserfiche) replace "https://ExampleInvalidDomain/ReportingService" to "https://YourAuditTrailHostFQDN/ReportingService"
6. Backup %Install folder%/Analytics Engine/ChartSVGService/configuration.json, (default install folder is %programFiles%/Laserfiche) replace "https://ExampleInvalidDomain/AnalyticsEngine" to "https://YourAuditTrailHostFQDN/AnalyticsEngine"
7. Backup %Install folder%/Audit Trail/WebAuditReport/web.config, (default install folder is %programFiles%/Laserfiche) in appSettings section, replace <add key="AnalyticsEngineAddress" value="ExampleInvalidDomain" /> to <add key="AnalyticsEngineAddress" value="https://YourAuditTrailHostFQDN/AnalyticsEngine" />
8. Restart the following Windows services:
   • LfAnalyticsEngine
   • LfChartSVGService
9. Wait at most 30 seconds until the services are ready.

Q: What if the IIS site hosting Audit Trail is configured to use a non-default port for HTTP or HTTPS?

By default, Audit Trail lets you configure HTTP on port 80 and HTTPS on port 443 in your IIS site. Audit Trail may not be available if your IIS site doesn't use the default port.

Specify the port number when browsing to the Audit Trail Reporting site. For example, use the following URL if port 8000 is configured for HTTP: http://AuditTrailHostFQDN:8000/AuditTrail

If you want to show charts using Audit Trail:

• Find %Install folder%/Audit Trail/WebAuditReport/web.config, (default install folder is %programFiles%/Laserfiche) in appSettings section, find something like <add key="AnalyticsEngineAddress" value="" /> and change it to <add key="AnalyticsEngineAddress" value="https://%FQDN%:%https port%/AnalyticsEngine" />
• Stop the Windows service: LfChartSVGService
• Find %Install folder%/Analytics Engine/ChartSVGService/configuration.json, (default install folder is %programFiles%/Laserfiche) find siteAddress and replace its value to "https://%FQDN%:%https port%/AnalyticsEngine"
• Restart the Windows service: LfChartSVGService

Q: What should I do if there are no default reports for a newly added/migrated repository?

You may see the following warning in the Laserfiche-AuditTrail-Service/Admin log through the Windows Event Viewer.

"Failed to create default reports for %repository name%"

1. Backup %Install folder%/Audit Trail/WebAuditConfig/web.config (default install folder is %programFiles%/Laserfiche).
2. In appSettings section, add or replace <add key="ReportSiteEndpoint" value="%audit trail report site base url%" /> with a valid Audit Trail Reporting Site URL. The %audit trail report site base url% is in the format "http://localhost:%port%/AuditTrail" or "https://%FQDN%:%port%/AuditTrail". Open the URL in a web browser to check that the URL loads correctly.

Q: How much disk space should I reserve to contain my audit catalog?

The audit catalog is roughly 15x the size of the original uncompressed audit log files within the date range. Audit Trail may consume extra disk space when you perform actions on the Audit Trail Configuration page.

Q: Can I use a shared Laserfiche Full-Text Search Engine (LFFTS) instance for Audit Trail?

Laserfiche recommends that Audit Trail use an individual LFFTS instance on the same server as Audit Trail for better performance. However, you can select a different LFFTS instance when adding a date range.

For previous installations (before Update 4), you can modify Audit Trail configuration files to point to a shared LFFTS instance.

1. Remove all repositories from Audit Trail Configuration Site.
2. Stop the Laserfiche Audit Trail Importing Service and Laserfiche Audit Trail Reporting Service.
3. Open the following 2 files:
   • %ProgramData%\Laserfiche\AuditAnalytics\ImportService.json
   • %ProgramData%\Laserfiche\AuditAnalytics\ReportService.json
4. Locate the Fts block and for each Host property, modify the "localhost" value to the machine name where the Laserfiche Full-Text Search Engine is located.
5. Take note of the CatalogFolder property. The defined path must be accessible from the machine where the Laserfiche Full-Text Search Engine is located.
6. Start Laserfiche Audit Trail Importing Service and Laserfiche Audit Trail Reporting Service.

Q: What's the purpose of the Detach/Attach button on the Search Engine configuration page on the Audit Trail Configuration page?

It's only applicable for installations before Update 4. It can be used to move the search catalog from one location to another. You can detach the catalog, move the catalog folder to another location, and attach the new folder location. You may also detach the catalog to re-index the search catalog.

Q: I can search audit events on the Audit Trail Reporting site but I can't see my saved audit reports. I’m also not able to save a new report. What is happening and how can I resolve this?

The cause might be corruption with the storage location of the audit report. To reset this:

1. Back up and delete the storage location by moving folder "%ProgramData%\Laserfiche\AuditAnalytics\report_templates\" to another location.
2. Restart the "Laserfiche Audit Trail Reporting Service" and the "Laserfiche Audit Trail Importing Service".

You should then be able to create and save a new report on the Audit Trail Reporting site, but previously saved reports will be unavailable. Currently, there is no direct way to recover previous reports. Due to possible corruption, there is also no guarantee of recovery. You can file a support case with the backup of the storage location if you want to recover a previous report.

Q: Searching on the Audit Trail Reporting Site intermittently fails. What are the possible causes?

A common cause of this intermittent failure is that one or more manually added folders include active audit logs of a Laserfiche Server repository listed under the Repositories tab on the Audit Trail Configuration Site. To address the issue:

1. Make sure the added folders do not include any active audit log files.
2. Remove the incorrect search catalog and re-add a new one under the Search Catalogs tab.

To generate reports on archived logs only, run the Repository Setup Wizard, choose the Folder option, and add the folders, including archived logs only.

To generate reports on active audit logs along with the archived logs, run the Repository Setup Wizard, choose the Repository and Folder option, and add the folders, including archived logs only.

Q: Why can't Audit Trail set the Forms default audit log folder to a network path?

Please upgrade to Audit Trail 11 Update 5.

Q: I can't sign into the Audit Trail Configuration Site as local admin. Why?

Please upgrade to Audit Trail 11 Update 5.