Chapter 14. Using Audit

Table of Contents
14.1. Getting Started with Audit
14.2. Enabling Audit
14.3. Selecting Audit Events
14.4. Monitoring Data Points
14.5. Using Local Storage
14.6. Using Git Tracking
14.7. Locking the Configuration
14.8. Audit Event Structure
14.9. Typical Scenarios
14.10. Troubleshooting

14.1. Getting Started with Audit

Overview

The DataHub Audit feature provides a comprehensive record of system activity. It captures security events, configuration changes, connection activity, scripting operations, and other significant actions through four mechanisms:

  • Audit events — predefined events raised by DataHub components when significant actions occur. Events are organized into categories and associated with sources.

  • Audit data points — selected DataHub data points whose value changes are recorded as audit events.

  • Local storage — a local SQLite database that persists audit records for querying and CSV export.

  • Local Git tracking — a local Git repository that maintains a detailed version history of configuration file changes.

For a complete reference of all audit configuration options, see Audit in the Properties Window chapter.

Why Audit?

The audit trail supports several operational needs:

  • Compliance — maintain tamper-resistant records of system activity to satisfy regulatory requirements.

  • Security forensics — investigate authentication failures, unauthorized access attempts, and session activity.

  • Change accountability — track who changed what, when, and from where.

  • Operational visibility — monitor connection lifecycles, plugin activations, and system health in real time through DataHub data points.

Here are the types of questions the Audit capability helps you answer:

  • Security and Authentication

    • Who authenticated to the system in the last 24 hours, and from what IP addresses?

    • When did user `joe2` last authenticate, and from what IP address?

    • Were there any failed authentication attempts this week?

    • Which user accounts were created, modified, or deleted recently?

    • What roles or permission sets were changed, and when?

    • Who bypassed an authentication factor?

  • Configuration Changes

    • Who changed the MQTT Broker configuration?

    • What changes were made to the OPC UA configuration?

    • When was the security configuration last modified?

    • What configuration files were added, changed, or renamed (via Git tracking)?

  • Connectivity

    • When did the OPC UA Client connection last disconnect?

    • Which incoming connections were established or dropped today?

    • What outgoing connections failed this week?

  • Data Point Monitoring

    • Who changed the setpoint for the boiler on line 2, and when?

    • What values were written to a specific data point over the past week?

  • Application Lifecycle

    • When was the application last started or stopped?

    • Which plugins failed to activate, and when?

    • Were any plugin license states changed?

  • Web Content

    • What web content files were modified or deleted recently?

    • When was the web content last recached?

  • Audit Subsystem

    • When was local audit storage last started or stopped?

    • Were any old audit records purged, and how many?

  • Git Configuration History

    • What is the current status of the local Git repository for the configuration directory?

    • What files were included in the most recent configuration commit?