Get audit events from system log

GET http://IP address:port/prefix/audit/{HOSTNAME}/{ENDTIME}/{BEGINTIME}

{HOSTNAME}—Server name.

Note

The ENDTIME and BEGINTIME syntax is described in Get MM archive contents section.

Attention!

If ENDTIME < BEGINTIME in the request, then the events in the response will be sorted by time in ascending order.

If ENDTIME > BEGINTIME, then the events will be sorted in descending order.

Parametr	Required	Description
filter	No	List of events that can be represented both as a range separated with <-> and <:> and a simple code. The list of event types: 1—not shown in the event log 2—violation of BOT of audit events (e.g., it is edged manually) 3—violation of EOT of audit events (e.g., it is edged manually) 4 − some audit events are absent (e.g., they are deleted manually) 5—table entry is changed 6—inactive log (no events or log update mark) /// External events 7—user is added 8—user is deleted 9—user parameters are changed 10—role is added 11—role is deleted 12—role parameters are changed 13—user login 14—user logout 15—device is added 16—device is deleted 17—device parameters are changed 18—detection is added 19—detection is deleted 20—detection parameters are changed 21—archive is added 22—archive is deleted 23—archive parameters are changed 24—detection rule (macro) is created 25—detection rule (macro) is deleted 26—detection rule (macro) parameters are changed 27—alarm is initiated 28—area is armed 29—area is disarmed 30—export from archive is performed 31—notification sender (sound-, email-) is added 32—notification sender is deleted 33—notification sender parameters are changed 34—general parameter is changed 35—recording to the archive parameters are changed 36—agent of export is added 37—agent of export is deleted 38—agent of export parameters are changed 39—macro is created 40—macro is deleted 41—macro parameters are changed 42—alarm is processed by user 43—dangerous alarm 44—suspicious alarm 45—false alarm 46—skipped alarm 47—Server is included into Axxon-domain 48—Server is excluded from Axxon-domain 49—view archive 50—view camera 51—view layout 52—Forensic Search in the archive 53—area search by faces in the archive 54—area search by license plates in the archive 55—system log export 56—LDAP folder is added 57—LDAP folder is deleted 58—LDAP folder parameters are changed 59—layout created 60—layout removed 61—layout changed 62—user login failed 63—PTZ control 64—archive comment added 65—archive comment changed 66—license expired 67—logout due to user inaction 68—Client blocked due to user inaction 69—Client unlocked by user 70—Client blocked by user 71—unexpected Client shut-down

Sample request:

GET http://127.0.0.1:80/audit/SERVER1/past/future?filter=17-20,6,1:4

Sample response:

{
  "events": [
    {
      "data": {
        "component": "Camera3",
        "componentType": "camera",
        "device": "Camera3",
        "host": "SERVER1",
        "property": "vstream-virtual/folder",
        "setting": "Directory",
        "value": "D:/Movies/Spirit"
      },
      "eventType": 17,
      "timestamp": "20161205T120410.698000"
    },
    {
      "data": {
        "detector": "Face detection",
        "device": "Camera1",
        "host": "SERVER1"
      },
      "eventType": 18,
      "timestamp": "20161205T120459.319000"
    }
  ]
}

Page tree

Documentation for Axxon One 2.0. Documentation for other versions of Axxon One is available too.