How to view the Audit Log for Symantec Endpoint Protection Manager Web Services

book

Article ID: 161172

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager (SEPM) maintains an audit log of calls to its web services, and consequently its local and remote console logins. You want to know how to view this audit log.

Resolution

The audit log may be viewed by running the following query against the SEPM database:

use sem5;
select DATEADD(s, TIMESTAMP/1000, '1970-01-01 00:00:00') as DATETIME, *
     from V_AUDIT_LOG order by DATETIME desc;

if the datepart 'S' could not be identified by the Sygate database version (SEPM 14.3 MP1 and older), please try:

use sem5;
select DATEADD(second, TIMESTAMP/1000, '1970-01-01 00:00:00') as DATETIME, *
     from V_AUDIT_LOG order by DATETIME desc;