Auditing and Logging

This topic describes the different auditing and logging mechanisms you can perform in Archer.

Log Description

The following table describes the security-relevant logs provided by Archer.

Component	Location
Security Events Report	The instance database
Archer Error Logs	File system in the configured logging directory
Windows Event Logs	Event Viewer

Security Events Report

The Security Events report contains a list of all of the security-related events that have occurred in Archer. Archer recommends that administrators define and enforce a retention policy for the Archer Error logs, as well as the Windows Event logs, in accordance with your corporate IT policy and security best practices. This report includes the following security events:

• Access Role Created
• Access Role Deleted
• Access Role Modified
• Account Status Modified
• Configuration Administrator Added
• Configuration Administrator Deleted
• Content Administrator Added
• Content Administrator Deleted
• Failed User Login
• Full Application Content Delete
• Global Report Permission Granted
• Global Report Permission Removed
• LDAP Configuration Delete Started
• LDAP Configuration Delete Completed
• Maximum Login Retries Exceeded
• Offline Access Sync Requested - Download
• Offline Access Sync Requested - Upload
• Password Changed by Administrator
• Password Changed by User
• Reset Password Requested
• Role Assigned to User
• Role Removed from User
• Security Events Started
• Security Events Stopped
• Security Parameter Assignment Modified
• Security Parameter Created
• Security Parameter Deleted
• Security Parameter Modified
• Sub-Form Configuration Administrator Added
• Sub-Form Configuration Administrator Deleted
• User Account Added
• User Account Deleted
• User Account Modified
• User Added to Group
• User Full Name Modified
• User Login
• User Login Name Modified
• User Logout
• User Removed from Group

Archer error logs

You can configure the location of the Archer error log in the Archer Control Panel at both the installation and the instance level. The default log location for the instance is C:\ArcherFiles\logging.

Archer recommends that you configure the setting at the installation level and allow the location for the instance level to default based on the installation setting.

For more information, see "Logging Settings" and "Verify the Logging Properties" in the Archer Control Panel Help.

Log directory permissions

Archer recommends that you restrict the permissions on the log files folder to the same read, write, and modify permissions of the account that the IIS processes and the Archer-installed services are running.

Windows Event Logs

The Archer services and Web Application logs the following items in the Windows Event logs:

• Service Start (Application and System logs)
• Service Stop (Application and System logs)
• .NET Runtime Errors