Almost all Soffid components are audited in some way, so we could reference all the pages in the documentation.
Standard attributes
- **Date/Time**: date on which the action was performed.
- **Author**: user who launched the task. When the author is empty, the Syncserver launched this task.
- **Source IP**: IP or host where the action has been performed.
- **Action**: the task performed is specified.
- **Purpose**: is the name of the internal object (also the table of the database) which the action was performed.
- **User**: identity to which the action was performed.
- **Information system:** details on which information system the action was performed (if a role is involved in the action).
- **Role**: details the role with which the action was performed.
- **Account**: if the action has taken place on an account, it will be indicated on which one in this section.
- **DB**: name of the final system (agent)
- **Group**: group involved in the action
- **Network**: network involved in the action
- **Machine**: host involved in the action
- **Printer**: printer involved in the action
- **Domain**: domain of the role involved in the action
- **Domain value**: domain value of the domain of the role involved in the action
- **Mail domain**: mail domain involved in the action
- **Mail list**: mail list involved in the action
- **Mail list belongs**: mail list belongs involved in the action
- **Parameter**: parameter involved in the action
- **File**: flle involved in the action
- **Authorization**: authorization involved in the action
- **Federation**: federation involved in the action
- **Users domain**: users domain of the account involved in the action
- **Passwords domain**: password domain of the account involved in the action
- **Jump servers group**: jump servers group involved in the action
- **PAM session id**: PAM session id involved in the action
- **Action code**: action code of the action message involved in the action
## Actions
**"Query buttons"**
Allows you to query accounts through different search systems, [Quick and Advanced](https://bookstack.soffid.com/books/soffid-3-reference-guide/page/search-types "Search Types").
**"Table filter"**
It allows you to filter a column in the table based on the results loaded in it.
**Download CSV file**
Allows you to download a csv file with the information of audit records.
**View**
Allows you to add or remove columns to the table.
It is also possible to change the order of the columns.
## Examples
### Common querys
Here you have a list of common **Advanced** searches, you only have to copy, paste and search, e.g.
```
// User changes trace
calendar ge "2020-01-01T00:00:00.000+01:00" AND user co "admin"
// User actions trace
calendar ge "2020-01-01T00:00:00.000+01:00" AND author co "admin"
// Soffid accounts
calendar ge "2020-01-01T00:00:00.000+01:00" AND user co "admin" AND database co "soffid"
// Created accounts
calendar ge "2020-01-01T00:00:00.000+01:00" AND action co "C" AND object co "SC_ACCOUN"
// Removed objects
calendar ge "2020-01-01T00:00:00.000+01:00" AND action co "D" AND object co "SC_ACCOUN"
```