If ENDTIME < BEGINTIME in the request, then the events in the response will be sorted by time in ascending order.
If ENDTIME > BEGINTIME, then the events will be sorted in descending order.
Parameter
Required
Description
filter
No
List of events that can be represented both as a range separated with <-> and <:> and a simple code.
The list of event types:
7—user is added 8—user is deleted 9—user parameters are changed 10—role is added 11—role is deleted 12—role parameters are changed 13—user login 14—user logout 15—device is added 16—device is deleted 17—device parameters are changed 18—detection is added 19—detection is deleted 20—detection parameters are changed 21—archive is added 22—archive is deleted 23—archive parameters are changed 24—detection rule (macro) is created 25—detection rule (macro) is deleted 26—detection rule (macro) parameters are changed 27—alarm is initiated 28—area is armed 29—area is disarmed 30—export from archive is performed 31—notification sender (sound-, email-) is added 32—notification sender is deleted 33—notification sender parameters are changed 34—general parameter is changed 35—recording to the archive parameters are changed 36—agent of export is added 37—agent of export is deleted 38—agent of export parameters are changed 39—macro is created 40—macro is deleted 41—macro parameters are changed 42—alarm is processed by user 43—dangerous alarm 44—suspicious alarm 45—false alarm
47—Server is included into Axxon-domain 48—Server is excluded from Axxon-domain 49—view archive 50—view camera 51—view layout
55—system log export 56—LDAP folder is added 57—LDAP folder is deleted 58—LDAP folder parameters are changed 59—layout created 60—layout removed 61—layout changed 62—user login failed 63—PTZ control 64—archive comment added 65—archive comment changed
74—counter added 75—counter removed 76—counter started 77—notification postponed 78—version reset/restored 79—backup applied 80—archive replication started 81—template linked 82—template unlinked 83—camera included in group 84—camera excluded from group 85—archive interval removed
Sample request:
GET http://127.0.0.1:80/audit/SERVER1/past/future?filter=17-20,6,1:4
The limit of alarms in the response. If not specified, it is equal to 100, by default
offset
No
The results offset by the specified number. For example, if a query withoffset=0returned 100 results, then in order to get the next results, it is necessary to run a query withoffset=100. If the second query returned 250 results, then in order to get the next results, it is necessary to run a query withoffset=350, and so on
The raisedAt field is not unique, so it can be necessary to skip the previously received alarms starting from the search interval
reasons
Possible values in the reasons array: armed, disarmed, userAlert, ruleAlert, videoDetector, audioDetector, ray
severity
Possible values of the severity field: unclassified, false, notice, warning, alarm
initiator
Possible values of the initiator field:
Name of the user who initiated the alarm.
Id of the macro (see Macros) if the alarm is initiated by macro that wasn't started by the detection tool (even if this macro has already been removed from the configuration).
