Find Events related to a Specific Item

3361
7
09-24-2018 01:50 PM
KellyGerrow
Esri Frequent Contributor
2 7 3,361

The September 2018 release of ArcGIS  contained the ability to export an activity log,  which contains history of actions made to content, members, organizations, and groups in your ArcGIS  organization. This blog outlines some basics of understanding the history log: https://www.esri.com/arcgis-blog/products/arcgis-/administration/exploring-the-organization-activity... 

This series of blogs will show quick ways of filtering the activity blog to find specific information. I've removed some information from the attached logs, so please note, IP address, org id and reqid are not included. This is also a fictional organization, with minimal events to make it easier to find specific events.  

What happened to my item? 

Scenario:

An item, b0a01e2e668f40168aa6d9a753efacb, that was supposed to be hidden until a press release on Wednesday, February 28, 2018. was made public early. Use the history log to determine who updated the items sharing privileges and when this occurred.

Detective Steps:

1. Download the Activity log setting the start date so that it will capture the time span in questions (Feb 26, 2018)

2. Open the CSV as an excel document

3. Input the itemID in the search bar in excel

Filter for Item

4. Filter the action column to view all share actions

5. Look at the data column and determine which event updated the sharing to everyone:true.

Notice it appears that Donna Content username shared the item publicly right after Brandon Analyst shared with a specific group.

7 Comments
JamesGustine
New Contributor III

Looking for a report just like this for security audits. Is this report available in portal 10.6.1?

JamesGustine
New Contributor III

Nevermind, just saw it was in the new sept 2018 update. When will this log be availble in portal?

KellyGerrow
Esri Frequent Contributor

Hi James,

There is no release date planned for this functionality in ArcGIS Enterprise (portal) due to a difference in infrastructure between ArcGIS  and ArcGIS Enterprise. I have passed along this request to the team and will post updates as they come. I'd suggest logging an idea on the ideas site, and sharing what information you would like to track in ArcGIS Enterprise. Thomas Edghill

mydliar
Esri Contributor

Hi Kelly Gerrow, how often and how reliably are the 'login' actions logged in the activity log? We see instances when apps (probably with stored credentials) do not always leave a 'login' entry in the log. Would be good to understand the exact logic.

Thanks,

Martin

KellyGerrow
Esri Frequent Contributor

Thanks for the question, I wrote a new workflow about querying specifically login information:

https://community.esri.com/community/gis/web-gis/arcgisonline/blog/2019/03/15/find-user-login-events...

A login action is recorded everytime a successful call is made to the oath2 or generate token login. If you click “Keep me signed in” on the ArcGIS login form then the token will be valid for 2 weeks; the /signin endpoint will not be called and no record will be added to the history log.

NataliyaLys
Occasional Contributor II

Hi Kelly Gerrow‌,

We are testing the Hub Community, and would like to know how our community users are creating they accounts. We know they can use Facebook, Gmail, or AGO login. But what we don't know, is which application they start with to do that? Our Hub Community is linked to our regular AGO organization, and any application that has login enabled will theoretically have an option for user to create an AGO community account.  

We would like to know what is that initial site that user starts with to create an account. Can we find that our either through activity log or API? 

Thank you,

Nataliya

KellyGerrow
Esri Frequent Contributor

Hi Nataliya,

Thanks for reaching out. I don't think the activity log tracks the information that you are looking for, but I'd like to know more about what specific applications you would like the tracking from. Could you share links or descriptions of the possible entry points that you would like to track from your hub site? you can either post them here, or send me an email at kgerrow@esri.com.

Thanks,

Kelly

About the Author
I love interactive maps and apps on the internet! The maps and apps that customers create and share on the web, make my job awesome. I'm a Product Manager with the ArcGIS Online team in Redlands, California. I am a proud graduate from Carleton University and the COGS in Canada, with research focus' in Health Geography. Originally from Bedford, NS, Canada but have spent a lot of time in Haliburton and Ottawa, Ontario. I have a passion for the outdoors and dogs.