Can I Audit Goliath Console User Activity?

You can review user activity ranging from user login to monitoring rules changes and many things in between. In order to do so, you will need access to the Goliath Server.

To view user logins to the GPM console

• For GPM versions prior to v14.0:
  1. Access the GPM Server and find the MonitorIT*.log files in the C:\Program Files\MonitorIT\Bin or C:\Program Files (x86)\MonitorIT\Bin folder.
  2. Using a text editor, use the find command and look for the string "Validate User Logon". You will find entries with specific user names and the times when they accessed the GPM console.

• For GPM version v14.0 and later:
  1. Access the GPM Server and find the GPMServer.log files in the C:\Program Files\MonitorIT\Bin or C:\Program Files (x86)\MonitorIT\Bin folder.
  2. Using a text editor, use the find command and look for the string "Validate User Logon". You will find entries with specific user names and the times when they accessed the GPM console.

To view user activity within the GPM console

1. User activity can be reviewed by accessing the MonitorITAudit.log which can be found at C:\Program Files\MonitorIT\Bin or C:\Program Files (x86)\MonitorIT\Bin by default.

Review the chart below to determine what term(s) to search for in the MonitorITAudit.log file, to find the needed info. All events will include the date and timestamp of the event and if Role Based Security is configured, the user who executed event.