View audit logs

You can view audit event logs on the Audit Log page. Audit logs are retained on the Knox Manage servers for 93 days.

View audit events

To view the audit event log, complete the following steps:

1. Navigate to History > Audit Log.

2. (Optional) Enter values for any of the following filters. To reset already-applied filters, click Reset.

   • User ID — Enter a user ID or equivalent source to only see log entries for that user or source.

     • If the audit event occured while sending a device command or administering Knox Manage, enter the admin’s user ID.
     • If the audit event occured on the server due to a scheduled task, enter “SYSTEM”, “System”, or (if known) the batch user ID.

   • Device Name — Enter a device name to only see events that occured on that device.

   • Result — Returns log events based on the outcome. Options are:

     • All (default) — Returns all events regardless of outcome.
     • Success — Only returns events that succeeded.
     • Failure — Only returns events that failed.

   • Log Date & Time (defaults to current day) — Lets you specify a date and time range to view log events that occured during that period. You can only specify hourly intervals for the time portion. The time selector uses a 24-hour clock format.

   • Audit Type — Lets you specify one of the following audit event types:

     • Console (default) — Returns a history of device commands sent from the Knox Manage console.

     • Server — Returns a history of server-side events, such as for batch processing jobs.

     • Device — Returns a history of on-device changes, such as due to applying policies and device enrollment.

     • Event Category — Lets you specify an event category. Availability of event categories depends on events that are already logged for you across all Audit Type events. Defaults to All.

     • Event — Enter an event name to only view log entries for that event.

       For a list of all possible audit events, see Device audit events, Server audit events, and Console audit events.

   • You can also search for audit logs by using the search field. Search within search results is available.

3. Click Search. Matching events appear on the page.

4. Click to view details of a specific event. You can view the following information:

   • Process information for the event, which appears under the Process Info tab:

     • Request History — Shows details about the event’s origin, such as the tenant name, URL, and browser type.
     • Result Code — Shows the result code for the event request, such as Success (0).
     • Result History — Shows additional details about the request outcome.

     

   • Log data for the event, which appears under the Log Data tab (if applicable). The type of log data displayed varies depending on the event category.

5. Click the View column value to see further details (only available for applicable events). The Audit Event window opens.

   Click the View column’s tooltip to see an explanation of event request abbreviations.

6. Inspect entries in the Audit Event window as needed. The Request ID helps track how the overall request is applied against a device. To view more information about a particular audit event, click .

   

View Knox Service Plugin feedback

For Samsung’s partners in the Knox Validated Program, the Audit Log page provides you with a history of messages sent by instances of the Knox Service Plugin (KSP) within your device fleet. The plugin, when installed on devices, sends messages related to licensing and policy payloads.

To view Knox Service Plugin feedback in your tenant:

1. Go to History > Audit Log.

2. Click KSP Feedback to open the feedback log.

3. (Optional) To view which devices sent a message and when, click the number in the Devices column next to the message. The message details opens in a separate dialog.