GET http://IP-address:port/prefix/audit/{HOSTNAME}/{ENDTIME}/{BEGINTIME}

{HOSTNAME} - Server name.


The ENDTIME and BEGINTIME syntax is described in Get MM archive contents section.


If ENDTIME < BEGINTIME in the request, then the events in the response will be sorted by time in ascending order.

If ENDTIME > BEGINTIME, then the events will be sorted in descending order.


ParametrRequiredDescription

filter

No

List of events that can be represented both as a range separated with <-> and <:> and a simple code.

The list of event types:

1 - not shown in the event log
2 - violation of BOT of audit events (e.g., it is edged manually)
3 - violation of EOT of audit events (e.g., it is edged manually)
4 - some audit events are absent (e.g., they are deleted manually)
5 - table entry is changed
6 - inactive log (no events or log update mark)
/// External events
7 - user is added
8 - user is deleted
9 - user parameters are changed
10 - role is added
11 - role is deleted
12 - role parameters are changed
13 - user login
14 - user logout
15 - device is added
16 - device is deleted
17 - device parameters are changed
18 - detection is added
19 - detection is deleted
20 - detection parameters are changed
21 - archive is added
22 - archive is deleted
23 - archive parameters are changed
24 - detection rule (macro) is created
25 - detection rule (macro) is deleted
26 - detection rule (macro) parameters are changed
27 - alarm is triggered
28 - zone is armed
29 - zone is disarmed
30 - export from archive is performed
31 - notification sender (sound-, email-, sms-) is added
32 - notification sender is deleted
33 - notification sender parameters are changed
34 - general parameter is changed
35 - recording to the archive parameters are changed
36 - agent of export is added
37 - agent of export is deleted
38 - agent of export parameters are changed
39 - macro is created
40 - macro is deleted
41 - macro parameters are changed
42 - alarm is processed by user
43 - dangerous alarm
44 - suspicious alarm
45 - false alarm
46 - skipped alarm
47 - Server is included into Axxon-domain
48 - Server is excluded from Axxon-domain
49 - view archive
50 - view camera
51 - view layout
52 - forensic search in the archive
53 - area search by faces in the archive
54 - area search by license plates in the archive
55 - system log export
56 - LDAP folder is added
57 - LDAP folder is deleted
58 - LDAP folder parameters are changed
59 - layout created
60 - layout removed
61 - layout changed
62 - user login failed
63 - PTZ control
64 - archive comment added
65 - archive comment changed
66 - license expired
67 - logout due to user inaction
68 - client blocked due to user inaction
69 - client unlocked by user
70 - client blocked by user
71 - unexpected client shut-down


Sample request:

GET http://127.0.0.1:80/audit/SERVER1/past/future?filter=17-20,6,1:4

Sample response:

{
  "events": [
    {
      "data": {
        "component": "Camera3",
        "componentType": "camera",
        "device": "Camera3",
        "host": "SERVER1",
        "property": "vstream-virtual/folder",
        "setting": "Directory",
        "value": "D:/Movies/Spirit"
      },
      "eventType": 17,
      "timestamp": "20161205T120410.698000"
    },
    {
      "data": {
        "detector": "Face detection",
        "device": "Camera1",
        "host": "SERVER1"
      },
      "eventType": 18,
      "timestamp": "20161205T120459.319000"
    }
  ]
}