Specialized Administration > Analyzing System and Business Information > Auditing Administration > Configuring Audit Event Recording
  
Configuring Audit Event Recording
Out of the box, Windchill records:
• System usage (Login, Logout)
• Organization usage (Context Logon)
• Cross Site Request Forgery events
• Download events (Download, View Representations)
• License usage (Login Denial)
Any other specific events that you want recorded in the audit log must be enabled on an individual basis.
The auditing configuration file (<Windchill>/conf/auditing/configAudit.xml by default) determines which events are recorded for which object types. The configuration file is delivered with some predefined service events and summary events that can be captured and reported on. You will need to analyze your company's auditing rules to determine which specific events you want audited. By enabling only specific events, you thereby minimize the size of the audit log by preventing all events from automatically accumulating in the audit log. After adding, changing, or enabling additional events, restart your method server for the updates to take effect.
* 
Administrators need to weigh the benefits of greater security, such as enabling an audit event that can alert you to potential malicious activity, against optimized performance for your system. The extent to which security measures affect performance depends on many factors that are unique to your system. Impact could be minimal, but if performance concerns result from enabling an audit event, you have the option of disabling it, including any that are turned on out of the box.
In the configuration file, events are either specified as eventKey or eventType, depending on how they are executed in Windchill. The following table shows the event name as it appears in Windchill and the eventKey as it appears in the configAudit.xml file.
Event
eventKey
Add Role to Context Team
wt.inf.team.ContainerTeamServiceEvent/ADD_ROLE
Add Role to Life Cycle Team
wt.team.TeamServiceEvent/ADD_ROLE
Add Role to Organization
wt.inf.team.NmOrganizationServiceEvent/ADD_ROLE
Associate
wt.audit.AuditServiceEvent/ASSOCIATE
Change Implementation
wt.change2.ChangeService2Event/CHANGE_IMPLEMENTATION
Change Life Cycle State
wt.events.summary.ChangeLifecycleStateSummaryEvent
Check In
wt.events.summary.CheckinSummaryEvent
Check Out
wt.events.summary.CheckoutSummaryEvent
Complete
wt.events.summary.CompleteSummaryEvent
Context Logon
wt.inf.team.ContainerTeamServiceEvent/CONTAINER_LOGIN
Copy
wt.events.summary.CopySummaryEvent
Cross Site Request Forgery
wt.audit.AuditServiceEvent/CSRF
Deadline Change
ptc.projectmanagement.plan.ProjectManagecomentEvent/EPP_DEADLINE_CHANGE
Delete
wt.events.summary.DeleteSummaryEvent
Disassociate
wt.audit.AuditServiceEvent/DISASSOCIATE
Download
wt.content.ContentServiceEvent/READ_CONTENT
Edit Access Control
wt.events.summary.ModifyObjectAccessSummaryEvent
Edit Attributes
wt.events.summary.ModifySummaryEvent
Edit Content
wt.events.summary.ModifyContentSummaryEvent
Edit Group
wt.org.OrganizationServicesEvent/MEMBERSHIP_CHANGE
Edit Identity
wt.events.summary.ChangeIdentitySummaryEvent
Edit Team
wt.events.summary.ModifyTeamSummaryEvent
Export
wt.events.summary.ExportSummaryEvent
Finish Date Change
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_FINISH_CHANGE
Health Status Change
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_STATUS_CHANGE
Import
wt.events.summary.ImportSummaryEvent
Login
wt.session.SessionUserAuditEvent/login
Logout
wt.session.SessionUserAuditEvent/logout
Markup and Annotate
wt.events.summary.MarkupAnnotateSummaryEvent
Modify Access Policy
wt.events.summary.ModifyAccessPolicySummaryEvent
Modify Product Structure
wt.events.summary.ModifyProductStructureSummaryEvent
Modify Security Labels
wt.events.summary.ModifySecurityLabelsSummaryEvent
Move
wt.events.summary.MoveSummaryEvent
New Object
wt.events.summary.CreateSummaryEvent
New View Version
wt.events.summary.NewViewVersionSummaryEvent
One Off Version
wt.events.summary.OneOffVersionSummaryEvent
Owner Change
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_OWNER_CHANGE
PDM Checkout
wt.sandbox.SandboxServiceCheckoutEvent/POST_SB_CHECKOUT_EVENT
Percent Complete Change
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_PERCENT_CHANGE
Preference Change
wt.preference.PreferenceServiceEvent/POST_UPDATE
Purge
wt.vc.VersionControlServiceEvent/PRE_ROLLUP
Remove Role from Context Team
wt.inf.team.ContainerTeamServiceEvent/REMOVE_ROLE
Login Denied – Insufficient ADU License
wt.session.SessionUserAuditEvent/LoginDenied_InsufficientADULicense
Login Denied – License Unassigned
wt.session.SessionUserAuditEvent/LoginDenied_LicenseNotAssigned
Remove Role from Life Cycle Team
wt.team.TeamServiceEvent/REMOVE_ROLE
Remove Role from Organization
wt.inf.team.NmOrganizationServiceEvent/REMOVE_ROLE
Revise
wt.events.summary.ReviseNewVersionSummaryEvent
Risk Change
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_RISK_CHANGE
Search
com.ptc.windchill.enterprise.search.server.searchaudit.SearchAuditEvent/SEARCH_AUDIT_EVENT
Security Label Download Acknowledgment
wt.audit.AuditServiceEvent/SECURITY_LABEL_DOWLOAD_ACK
Sent To Print
wt.representation.SentToPrintEvent/SENT_TO_PRINT
Share
wt.events.summary.ShareSummaryEvent
Undo Checkout
wt.events.summary.UndoCheckoutSummaryEvent
User Password Change
wt.org.OrganizationServicesEvent/PASSWORD_CHANGE
View Properties
wt.audit.AuditServiceEvent/VIEW_PROPERTIES
View Representations
wt.representation.ViewEvent/VIEW
The following table shows the event name as it appears in Windchill as well as the eventType and the event entry as they appear in the configAudit.xml file. These are non-generic type of events.
* 
Events with (Classic) indicate that they apply to classic projects. For more information, see Converting Plan Types.
Event
eventType
Event Entry
Due Date Change (Classic)
DEADLINE_CHANGE
ProjectManagementEventEntry
Finish Date Change (Classic)
FINISH_CHANGE
ProjectManagementEventEntry
Health Status Change (Classic)
STATUS_CHANGE
ProjectManagementEventEntry
New Discussion
NEW_DISCUSSION
ForumEventEntry
Not Authorized Access
NOT_AUTHORIZED
AccessControlEventEntry
Owner Change (Classic)
OWNER_CHANGE
ProjectManagementEventEntry
Percent Complete Change (Classic)
PERCENT_CHANGE
ProjectManagementEventEntry
Rollback Iteration
POST_ROLLBACK
VCEventEntry
State Change (Classic)
STATE_CHANGE
ProjectManagementEventEntry
Workflow Activity State Change
ACTIVITY_STATE_CHANGED
WfEngineEventEntry
Workflow Activity Variable Change
ACTIVITY_CONTEXT_CHANGED
WfEngineEventEntry
Workflow State Change
PROCESS_STATE_CHANGED
WfEngineEventEntry
Workflow Variable Change
PROCESS_CONTEXT_CHANGED
WfEngineEventEntry
For a full description of all events, see the related topics listed below.
If you choose to enable additional events, add, or change the out-of-the-box auditing rules, PTC recommends that you follow the maintenance best practices for modifying PTC files as described Managing Customizations. Using the best practices, you create a backup of the original and apply your changes to a new file.