Review and export user activity logs

• Lists the websites users have attempted to visit.
• Displays a real-time log of what users are trying to access right now.
• Displays a graph showing the number of hits to domains and how many of those were blocked.

See current data

To view current log data or pause it, select Realtime.

See past data

1. Select a particular time:

     Note

   Your Datastore settings determine how much past data is available.

   • Use the Earlier and Later buttons to move forward or backwards one page of results.
   • Select a date and time.
   • Select a time from the graph.
2. Select Advanced to choose which columns to show. By default, every column except for Domain and SNI is selected, and you can’t remove the Time or Tenant columns.
   
   • Username
   • Source IP: Originating Source IP address or subnet range.
   • Group: User Group.
   • Code: HTTP response codes.
   • URL
   • Category
   • Policy: The Category or Category Group selected in the What step of the Web Filter Policy that applies to the request.

       Tip

     Select the field to go to the Policy wizard to edit the Web Filter Policy.

   • Domain
   • SNI: Shows Yes or No, depending on whether the SNI header is present.
3. Filter the logs if needed:
   
   • Select a Tenant or Group from the dropdown.
   • Enter text into the fields below the column headers for Username, Source IP, Code, URL, Category or Domain.
   • Select the down arrow and the Exact match checkbox for Source IP to only search for the IP specified.
   • Select Exclude in the URL column to filter out:
     
     • Images
     • JavaScript
     • CSS
     • Select User defined and specify a custom exclusion in the field.

Export the data

Select Export to download the logs in comma-separated (CSV) format.