Generating audit reports

The Auditing page lets administrators generate detailed reports about account activity. These reports are good for answering questions such as, Which users are setting up and receiving notifications? or Who deleted that virtual machine we were using?

You can view up to two years of audit data.

Contents

Creating an audit report

To create an audit report

  1. In the navigation bar, click Admin > Auditing.
  2. (Optional) Choose filters to apply to the report. For example, to generate an audit report for a single environment, enter the environment ID number in the Filter by Environment/Template field (see Finding the ID for a VM, VPN, environment, or template).

    Auditing Page

    By default, the report shows all account activity over the past 24 hours.

  3. Select an option for viewing the report:
    • To view the report in your browser, click Submit.

      Large reports can take a long time to generate.

    • To download the report, click Export CSV.
    • To have the report emailed to you, click Email CSV. The report is generated offline, and then a link to the report is emailed to the address associated with your user account.

      The report link expires after seven days.

Auditing report fields

The auditing report contains the following fields:

Field

Description

Time

The time the action occurred.

Region

The region (if any) in which the action occurred.

User

The login name of the user who initiated the action, including Skytap services.

auto_shutdown, usage_control, and auto_power_option refer to the Skytap automatic power options service. For more information about automatic power options, see Automatically shut down or suspend inactive environments.

Department

The department (if any) in which the action occurred.

Project

The project (if any) in which the action occurred.

Action

The action that the user initiated, such as signing in or deleting an environment.

Environment

The environment (if any) in which the action occurred.

Environment ID

The ID of the environment (visible only in the CSV report).

VMs Affected

The VMs that were affected by the action, or in which the action occurred.

In audit records for VM sequencing and environment state changes prior to April 2018, all of the environment VMs are included in the VMs Affected column, even if the action affected only a subset of VMs.

In April 2018, Skytap fixed a reporting bug.

  • For audit records created prior to the April 2018 release, the VMs Affected column contains all of the VMs in an environment when an environment-wide state change was applied or a VM sequencing action (run or shut down) took effect.
  • For audit records created after the April 2018 release, the VMs Affected column contains:

    • Only the VMs that were selected when an environment-wide state change (run, suspend, shut down, etc.) was applied.
    • Only the VMs that were in the VM sequencing stage group when the VM sequencing action took effect.

Templates Affected

The template (if any) in which the action occurred.

Template ID

The ID of the template (visible only in the CSV report).

Other Info

Additional information, such as the user IP address (during sign in) or the notification settings (when a notification is sent).

Description of auditing activities

Account settings
Activity name Description
Create Ip Range An administrator created an IP-based access policy for the account.
Create Ip Range An administrator created an IP-based access policy for the account.
Edit Ip Range An administrator edited an IP-based access policy for the account.
Quota Update An administrator changed a global or regional account limit.
Set Default Sharing Portal Support Url An administrator set the account-wide default for the support link that appears in sharing portals.
Update Access Policy An administrator changed an account-wide access policy.
Update Password Policy An administrator changed an account-wide password policy.
Update Sso Policy An administrator changed an account-wide SSO policy.
Update Account A user changed his or her account settings (for example, default region).
Update Automatic Power Setting An administrator changed the account-wide default automatic power options setting.

Assets
Activity name Description
Upload Asset A user or administrator uploaded an asset to his or her asset library.
Delete Asset A user or administrator deleted an asset in the asset library.

Containers
Activity name Description
Commission Container Host A VM was commissioned as a container host.
Control Container The power state of a container was changed or the container was killed or deleted.
Create Container A container was added to a container host VM.
Create Container Registry A container registry was added to the list of available registries.
Decommission Container Host A VM was changed from a container host to a standard VM.
Delete Container A container was removed from a container host VM.
Delete Container Registry A container registry was removed from the list of available registries.
Update Container Registry A container registry was changed.

Courses, classes, and labs

If the Skytap Cloud Classrooms extension is enabled in your account, see Auditing actions related to the Classrooms extension for a list of the additional auditing activities available to you.

Departments
Activity name Description
Add User To Department An administrator added a user to a department.
Create Department An administrator created a department.
Delete Department An administrator deleted a department.
Department Quota Update An administrator edited a department usage limit.
Remove User From Department An administrator removed a user from a department.
Update Department An administrator changed a department.

Environment management
Activity name Description
Copy Environment A user or administrator copied an environment.
Copy Environment To Region A user or administrator copied an environment to another region.
Create Environment A user or administrator created an environment from a template.
Delete Environment A user or administrator deleted an environment.
Delete Virtual Machines A user or administrator deleted one or more VMs in an environment.
Merge Environment A user or administrator added VMs to an environment.
Rate Limited Action Skytap delayed an action due to high amounts of activity.
Set Sharing Portal Support Url Non Default An administrator or user set a custom support link for a sharing portal.
Update Environment Autopower A user or administrator changed the automatic power settings for an environment.
Vnc Session A user, administrator, or anonymous sharing portal user has accessed a VM desktop using the SRA browser client or SmartRDP.

Environment networks
Activity name Description
Create Network A user or administrator created a network in an environment.
Create Tunnel A user or administrator connected two networks in different environments using ICNR.
Delete Network A user or administrator deleted a network in an environment.
Delete Tunnel A user or administrator removed the ICNR connection between two networks in different environments.

Environment power settings
Activity name Description
Power Off Environment A user, administrator, schedule, or anonymous sharing portal user powered off an environment.
Reset Environment A user, administrator, or anonymous sharing portal user restarted an environment.
Run Environment A user, administrator, schedule, or anonymous sharing portal user ran an environment.
Shutdown Environment A user, administrator, schedule, or anonymous sharing portal user shut down an environment.
Suspend Environment A user, administrator, schedule, or anonymous sharing portal user suspended an environment.

Environment VM sequencing
Activity name Description
Disable Vm Sequence A user or administrator disabled a VM sequence by setting all of the VMs in an environment to the Final Stage in the VM sequence.
Enable Vm Sequence A user or administrator enabled a VM sequence.
Update Vm Sequence A user or administrator changed the VM sequence settings in an environment.

Groups
Activity name Description
Add User To Group An administrator added a user to a group.
Create Group An administrator created a group.
Delete Group An administrator deleted a group.
Remove User From Group An administrator removed a user from a group.

Imports and exports
Activity name Description
Create Export Job A user or administrator created an export job to export a VM out of Skytap.
Create Import Job A user or administrator created an import job to import VMs into Skytap.
Delete Export Job A user or administrator deleted an export job.
Delete Import Job A user administrator deleted an import job.
Export Job Expired Skytap automatically deletes export jobs after 7 days.
Import Job Complete Skytap automatically deleted a successful import jobs after they successfully complete.
Import Job Expired Skytap automatically deleted a failed import job after 7 days.
Import Vm (Legacy) A VM was imported using the older import process.
Process Import Job Skytap processed an import job.

Labels
Activity name Description
Add Label A user or administrator added a label to an environment, template, schedule, or asset.
Create Label Category An administrator created a label category.
Disable Label Category An administrator disabled a label category.
Remove Label A user or administrator removed a label from an environment, template, schedule, or asset.
Update Label Category An administrator edited a label category.

Notifications
Activity name Description
Create Notification Rule A user or administrator created a notification rule.
Delete Notification Rule A user or administrator deleted a notification rule.
Modify Notification Rule A user or administrator changed a notification rule.
Send Notification Skytap sent a user or administrator a notification.

Projects and project roles
Activity name Description
Add To Project A user or administrator added an environment, template, asset, or user to a project.
Create Project A user or administrator created a project.
Create Role A user or administrator assigned a project role to a user.
Delete Project A user or administrator deleted a project.
Delete Role A user or administrator removed a user or group from a project role.
Remove From Project A user or administrator removed an environment, template, asset, or user from a project.

Public IP Addresses
Activity name Description
Add Public Ip Address A public IP address is added to the account.
Attach Public Ip Address To Vm Interface A public IP address is attached to the network adapter of a VM.
Detach Public Ip Address From Vm Interface A public IP address is removed from the network adapter of a VM.
Release Public Ip Address A public IP address is released from the account.

Published Services
Activity name Description
Create Published Service A published service is created and attached to a VM.
Delete Published Service A published service is removed from a VM.

Reporting
Activity name Description
Create Csv Export A user or administrator exported an auditing report, usage report, or list of resources as a CSV export.
Csv Export Email A user or administrator emailed an auditing report, usage report, or list of resources.
Update Csv Export Skytap updated a CSV export to indicate that it should be delivered via email.

Schedules
Activity name Description
Create Schedule A user or administrator created a schedule.
Delete Schedule A user or administrator deleted a schedule.
Finalize Schedule An automated schedule is complete.
Update Schedule A user or administrator changed a schedule.

Tags
Activity name Description
Add Tag A user or administrator added a tag to an environment or template.
Remove Tag A user or administrator removed a tag from an environment or template.

Templates
Activity name Description
Copy Template A user or administrator copied a template.
Copy Template To Region A user or administrator copied a template to another region.
Create Template From Environment A user or administrator saved an environment as a template.
Delete Template A user or administrator deleted a template.
Power Off Template Skytap powered off a template during an emergency maintenance activity.

User sign-in
Activity name Description
Anonymous Single Sign On Login A user or administrator used SSO to sign into Skytap.
Failed Sharing Portal Login An anonymous person failed to sign into a password-protected sharing portal.
Failed User Login A user or administrator failed an attempt to sign into Skytap.
Login A user or administrator successfully signed into Skytap.
Single Sign On Login A user or administrator signed into Skytap using SSO.

Users
Activity name Description
Api Token Reset A user has reset the API security token for his or her account.
Browser Activation A user has activated a browser that had not been previously registered for his or her account.
Change Owner Of All Resources An administrator reassigned all of the environments, templates, and assets owned by a user or another administrator.
Change Resource Owner An administrator reassigned an environment, template, or assets owned by a user or another administrator.
Create User An administrator created a user account.
Deactivate User An administrator deactivated a user account.
Delete User An administrator deleted a user account.
Grant User Export Permission An administrator granted a user the ability to export VMs out of Skytap.
Grant User Import Permission An administrator granted a user the ability to import VMs into Skytap.
Password Change A user has changed his or her password.
Revoke User Export Permission An administrator removed the ability for a user to export VMs out of Skytap.
Revoke User Import Permission An administrator removed the ability for a user to import VMs into Skytap.
Send Activation Link A user sent a user an account activation link.
Update User An administrator changed a user account.
User Quota Update An administrator edited a user usage limit.

VM hardware and network adapters
Activity name Description
Add Secondary Ip A user or administrator added a secondary IP to a network adapter for a VM.
Create Network Adapter A user or administrator created a network adapter on a VM in an environment.
Delete Network Adapter A user or administrator deleted a network adapter on a VM in an environment.
Delete Secondary Ip A user or administrator deleted a secondary IP from a network adapter for a VM.
Resize Vm Disk A user or administrator changed the size of the disk for a VM in an environment.
Update Hardware A user or administrator changed the hardware settings for a VM.
Update Network Adapter A user or administrator changed network adapter settings for a VM.

VPN connections and access
Activity name Description
Attach Vpn A user or administrator attached a VPN to a network in an environment.
Connect Vpn A user or administrator connected a VPN that is attached to a network in an environment.
Create Vpn An administrator created a VPN.
Delete Vpn An administrator deleted a VPN.
Detach Vpn A user or administrator detached a VPN from a network in an environment.
Disable Vpn An administrator disabled a VPN.
Disconnect Vpn A user or administrator disconnected a VPN from a network in an environment.
Enable Vpn An administrator enabled a VPN.
Remove All Users From Access An administrator set a VPN access control list to Customized access.
Remove Entity From Access An administrator removed a group, department, or user from the access control list for a VPN.
Update Access Control An administrator updated the access control list for a VPN.