Qlik Sense: Working with audit logs to check user activity on sheet/app level

[Patricia_Silva]

This article will guide you on how to check audit logs to see users' activity on object/sheet/app.

First of all, we would need to enable Audit Logs on Qlik Sense side, to do so, you can follow this guide.

Once done all the steps from the above's guide, then we can check all user activity on object/sheet/level through the Operations Monitor app (from Qlik Sense 2019 release).

In the example below we will see a graphic example of how to check this information from Audit Logs.

User with ID "f9b8183a-bc07-4571-8ccb-94f7a1c5d9db" navigates into app with ID "1e4a22db-7395-46b3-bd43-78bc4cef811f" and then clicks on sheet with ID "1e4a22db-7395-46b3-bd43-78bc4cef811f" and finally selects a dimension:

User performing selections on an app

As we enabled Audit Logs, all traces coming from users selections will be logged on this path location: C:\ProgramData\Qlik\Sense\Log\Engine\Trace\ServerName_Audit_Engine.txt

Now we can check the audit logs directly from Operations Monitor app:

1. Go to Qlik Sense Hub
2. Under streams on the left hand side, click on "Monitoring apps"
3. Then click on "Operations Monitor" app
4. Then we can filter the Audit Logs we enabled before so we can check which actions have been performed on sheet/app level by any user
5. In the example we can see in the gif below, we are performing the following selections to filter:
   1. We first filter by app (where we performed the selections on the bar chart)
   2. Then the gif also shows more filter examples that you could use to filter your data from Audit Logs

Checking logs through the Operations Monitor app

Furthermore, you could also check from logs the object ID and action performed on it on the following columns from C:\ProgramData\Qlik\Sense\Log\Engine\Trace\ServerName_Audit_Engine.txt:

Checking object ID and action performed

Environment

Qlik Sense Enterprise on Windows 

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Related Content 

How to enable Audit Logging in Qlik Sense Enterprise on Windows

[eduardo1988]

Hi Patricia!

¿How could I increase the registers stored in the AuditActivity_Engine.txt, avoiding the reset of this file in a new one?

Thanks in advance!

[Sonja_Bauernfeind]

Hello @eduardo1988 

Are you asking how to change the parameters which cause the Qlik Sense log files from rolling over into new ones (and be archived)?

This cannot be customised. The logs roll over as per these parameters:

• On a service restart
• If the file is reaching 8MB
• If the file is older than 12 hours

See How logging works in Qlik Sense Enterprise on Windows.

All the best,
Sonja

[eduardo1988]

Hello @Sonja_Bauernfeind 

Exactly.

We have developed a solution that reads from that log AuditActivity_Engine.txt, but we need to increase its rotation time to avoid reloading data extraction every 5-10min and thus not losing data records from that log.

Is there no way to configure that rotation time? or increase the file size (MB)?

Thanks in advance!

[Sonja_Bauernfeind]

Hello @eduardo1988 

This cannot be configured, no.

Can you instead of using the live file use the archived log files and handle them in bulk? Logs are not deleted, only moved. (Except for the reload/script logs, only 3 are kept for those.)

All the best,
Sonja 

[Sonja_Bauernfeind]

Hello again @eduardo1988 

I forgot to mention: If you'd like to see this feature enabled (configure how frequently a log is rolled over), I'd recommend logging an idea with us.

All the best,
Sonja 

[eduardo1988]

Hi again @Sonja_Bauernfeind 

Thanks a lot for your help!

Appreciate it!

Best regards, 

Eduardo

[mary_papadopoulou]

Hello @Patricia_Silva ,

I use both  Operations Monitor  app and the Audit Engine file. The need is to create a report on actions performed per app and sheet. 

Unfortunately, the object ids in the Audit Engine file do not match the ids from Operations Monitor and I cannot link at sheet level. As a result, I have only information about the App name, not the sheet name.

The strange thing is that the object IDs from the audit file do not exist at all in Operations Monitor  app. 

Have you faces this problem? Is there any other way to extract Object ID? 

[Sonja_Bauernfeind]

Hello @mary_papadopoulou 

I recommend posting your question directly in our Qlik Sense Management forum. There, it will be visible to our active userbase and our active support agents.

All the best,
Sonja