Audit Log; Enabling Audit Log; Saving An Audit Log; Interpreting The Audit Log - Xerox WorkCentre 7120 System Administrator Manual

Security

Audit Log

When the Audit Log feature is enabled, the printer begins recording events that happen on the printer.
You can download the Audit Log as a tab-delimited text file, and review it to find security breaches and
assess the printer's security.

Enabling Audit Log

Note: Secure HTTP (SSL) must be enabled before you can enable Audit Log. For details, see
Configuring Secure HTTP and SSL/TLS Settings
1. In CentreWare IS, click Properties > Security > Audit Log.
Next to Audit Log, select Enabled.
2.
3. Click Apply to accept the changes or Undo to retain the previous settings.

Saving an Audit Log

1. In CentreWare IS, click Properties > Security > Audit Log.
2. Under Export Audit Log, right-click the Export as text file link and save the compressed
auditfile.txt file to your computer.
3. Open the file in an application that can read a tab-delimited text file.

Interpreting the Audit Log

The Audit Log is formatted into columns
Log ID: A unique value that identifies the event.
•
• Date: The date that the event happened in mm/dd/yy format.
• Time: The time that the event happened in hh:mm:ss format.
• Audit Event ID: The type of event. The number corresponds to a unique description.
• Logged Events: An abbreviated description of the type of event.
Notes:
• One audit log entry is recorded for each network destination within a Network Scanning
scan job.
• For Server Fax jobs: One audit log entry is recorded for each Server Fax job.
• For Email jobs: One audit log entry is recorded for each SMTP recipient within the job.
User Name: User Name, Job Name, Computer Name, Printer Name, Folder Name, or Accounting
•
Account ID (when Network Accounting is enabled).
Note: Network Authentication must be configured to record the user's name in the Audit Log.
• Description: More information about the Logged Event. When the Logged Event is System Status
for example, one of the following may be displayed:
• Started normally (cold boot)
• Started normally (warm boot)
68 WorkCentre 7120/7125 Multifunction Printer
System Administrator Guide
on page 59.