Review activity logs

The Activity logs page features several types of logs which display the history of various actions performed on the Knox Manage console. On this page you can view the following logs: activity, certificates, Knox Service Plugin, API integration, API client, and identity provider. Most of these logs are comparable to audit logs in the original console.

Activity log

The ACTIVITY tab provides a history of actions performed on the Knox Manage console across all admins. This includes events such as signing in to the console, adding new users, and viewing specific pages.

You can apply the following criteria when you search for logs:

• Date and time — Set a date and time range. By default, the current day is selected. The date is based on the local time of the admin who performed the action.
• Admin — Select the admin who requested the action.
• Device name — Enter the name of the device that the action was performed on.
• Log event — Enter the log event description.
• Result — Select whether the request succeeded or failed.
• Log type — Select the log type: Console, Device, or Server. By default, Console is selected.
• Category — Select a category, such as Alert or Device.

You can also set similar filters depending on what types of logs you want to view:

• ADMIN — Select an admin.
• NAME of the admin.
• CATEGORY — The category of the event.
• RESULT — The result of the event, either Failure or Success.
• LOG TYPE — The log type, either Console, Device, or Server.

You can download the activity log data as a CSV file. Click DOWNLOAD AS CSV. Once the download is ready, it will appear in your notifications under the on the top right of the Knox Admin Portal. Click DOWNLOAD on the notification. A zip file containing the logs downloads to your device.

Additionally, you can also sort logs by the date of the event. The date is based on the admin’s local time, in ascending or descending order.

To view more log data, click View details. The Log details page opens.

Certificates log

The CERTIFICATES tab allows you to view the issue history of certificates.

You can filter the logs by:

• DEVICE NAME — The device name.
• TEMPLATE NAME — The certificate template.
• USER ID — The ID of the user.
• STATUS — The status of the certificate.
• ISSUED DATE — The date the certificate was issued.
• EXPIRATION DATE — The date the certificate expires.

Knox Service Plugin log

The KNOX SERVICE PLUGIN tab allows you to view the message history of the Knox Service Plugin. The plugin, when installed on your devices, sends messages related to licensing and policy payloads.

You can search for logs by setting the date range or specifying a device name. You can also apply the following filters:

• RESULT — The result of the event, either Failure or Success.
• DATE — The date of the event. The date is based on the admin’s local time, in ascending or descending order.

API integration logs

The API INTEGRATION tab allows you to view the records of successful and unsucessful API calls. You can search for a log by client ID and date. You can also filter the logs by client ID, authentication result, and day range.

API client logs

The API CLIENT tab allows you to view all of the logs for the API clients you generated in the Knox Manage console.

You can search for a log by its client ID, API name, or date and time. You can also filter the logs by the result of each authentication attempt.

To learn more about a log event, click View details.

You can download the API client log data as a CSV file. Click DOWNLOAD AS CSV. Once the download is ready, it will appear in your notifications under the on the top right of the Knox Admin Portal. Click DOWNLOAD on the notification. A zip file containing the logs downloads to your device.

Identity provider logs

You can view IdP event logs on the IDENTITY PROVIDER tab. You can search and filter logs by day range, connection name, sync target, and event start and end times.

You can also select an entry and click SYNC to trigger a sync for those users or groups.