Skip to content

Audit trails

Who opened it, what they searched for, and where they sent it.

Content Central writes down every sign-in, search, view, download, change, email and delete, with the person, the time and the IP address. You read it in the Event Viewer, and on each document's own history.

Book a free demoFollow one investigation
Drawn after the Event Viewer in Content Central, with example users and documents. Admins filter by action, user and date range.

Three records, each answering a different question.

Across the system

Event Viewer

"What did this person do last Tuesday?" Every logged action across every catalog, filtered by action, user and dates.

On one document

Version History

"What happened to this contract?" Created, changed, checked in, approved, signed, moved, put on a retention policy: in order, with names and times.

See a version history

For sensitive types

Reason for Access

"Why did they open it?" Turn it on per document type and nobody opens one without typing a reason, which is kept in the document's history.

Document security

One investigation

A W-2 reached an outside inbox. How did it get there?

The kind of question a privacy officer or HR director gets with no warning. The example uses the events drawn above.

  1. 1

    Filter the Event Viewer.

    Action: Email. Date range: the last two weeks. The W-2 shows up at 9:14 on June 12, sent by dbrooks, with the outside recipient named.

  2. 2

    Read the minutes before it.

    Clear the action filter and pick the user. A login from the usual office IP at 9:10, a search for "Alvarez", a view, then the email. It was a person at their desk, not a stolen password from somewhere else.

  3. 3

    Open the document.

    HR turned on Require Reason for Access for W-2s, so the document’s own version history shows the reason dbrooks typed before opening it.

  4. 4

    Close the gap.

    Check who can email that document type, and make password-protected ZIP the rule for emailed attachments.

What goes in the log.

Signing in

  • Logins, with IP address, browser and whether they succeeded
  • Logouts

Looking for things

  • Searches, with the words searched and the catalogs searched

Looking at things

  • Views
  • Downloads

Changing things

  • Captures, with how the document came in
  • Field changes
  • Check-out and check-in
  • New revisions, replaced and added pages
  • Deletes and renames

Sending things

  • Emails, with recipients and subject

Deciding things

  • Approvals made with a PIN
  • Completed signatures
  • Substitutes named during an absence

Documents filed by the background capture service show CaptureService where a person's IP address would be, so you can tell scanning and email capture from someone at a keyboard.

Four things to know about the log.

It cannot be switched off.
There is no setting to stop logging one kind of action. Every logged action is recorded, every time.
The server writes it.
Each entry is written by the server as the action completes, never sent in from someone’s browser.
You decide how long it is kept.
Purge Days sets how many days of events to keep. Leave it empty and events are kept forever. Set it to match your retention policy.
It is read on screen.
Admins search the Event Viewer by action, user and date range. Plan to show it on screen rather than hand over a file.
The audit trail, in the help library

The audit trail is one of the controls on the compliance page, next to permissions, version history and records retention.

Compliance checklist

Free live demo

Bring a question you could not answer at your last audit. We will find it in the log.

Book a free demo and we will show you around, answer your questions and run your real paperwork through it. No cost, no pressure.

  • A live tour of the products that fit your work
  • Your own documents, set up and shown working
  • Your workflow and process, mapped with you
  • Straight answers from people who build it
Book a free demo(863) 937-0272
Engraved illustration: file boxes, a document scanner and a PC at a desk