Get audit events from system log

GET http://IP-Address:port/prefix/audit/{HOSTNAME}/{ENDTIME}/{BEGINTIME}

{HOSTNAME} − Server name.

Note

The ENDTIME and BEGINTIME syntax is described in Get archive contents section.

Attention!

If ENDTIME < BEGINTIME in the request, then the events in the response will be sorted by time in ascending order.

If ENDTIME > BEGINTIME, then the events will be sorted in descending order.

Parametr	Required	Description
filter	No	List of events that can be represented both as a range separated with <-> and <:> and a simple code. The list of event types: 1 − not shown in the event log 2 − violation of BOT of audit events (e.g., it is edged manually) 3 − violation of EOT of audit events (e.g., it is edged manually) 4 − some audit events are absent (e.g., they are deleted manually) 5 − table entry is changed 6 − inactive log (no events or log update mark) /// External events 7 − user is added 8 − user is deleted 9 − user parameters are changed 10 − role is added 11 − role is deleted 12 − role parameters are changed 13 − user login 14 − user logout 15 − device is added 16 − device is deleted 17 − device parameters are changed 18 − detection is added 19 − detection is deleted 20 − detection parameters are changed 21 − archive is added 22 − archive is deleted 23 − archive parameters are changed 24 − detection rule (macro) is created 25 − detection rule (macro) is deleted 26 − detection rule (macro) parameters are changed 27 − alarm is triggered 28 − zone is armed 29 − zone is disarmed 30 − export from archive is performed 31 − notification sender (sound-, email-) is added 32 − notification sender is deleted 33 − notification sender parameters are changed 34 − general parameter is changed 35 − recording to the archive parameters are changed 36 − agent of export is added 37 − agent of export is deleted 38 − agent of export parameters are changed 39 − macro is created 40 − macro is deleted 41 − macro parameters are changed 42 − alarm is processed by user 43 − dangerous alarm 44 − suspicious alarm 45 − false alarm 46 − skipped alarm 47 − Server is included into Domain 48 − Server is excluded from Domain 49 − view archive 50 − view camera 51 − view layout 52 − forensic search in the archive 53 − area search by faces in the archive 54 − area search by license plates in the archive 55 − system log export 56 − LDAP folder is added 57 − LDAP folder is deleted 58 − LDAP folder parameters are changed 59 − layout created 60 − layout removed 61 − layout changed 62 − user login failed 63 − PTZ control 64 − archive comment added 65 − archive comment changed 66 − license expired 67 − logout due to user inaction 68 − client blocked due to user inaction 69 − client unlocked by user 70 − client blocked by user 71 − unexpected client shut-down

Sample request:

GET http://127.0.0.1:80/audit/SERVER1/past/future?filter=17-20,6,1:4

Sample response:

{
  "events": [
    {
      "data": {
        "component": "Camera3",
        "componentType": "camera",
        "device": "Camera3",
        "host": "SERVER1",
        "property": "vstream-virtual/folder",
        "setting": "Directory",
        "value": "D:/Movies/Spirit"
      },
      "eventType": 17,
      "timestamp": "20161205T120410.698000"
    },
    {
      "data": {
        "detector": "Face detection",
        "device": "Camera1",
        "host": "SERVER1"
      },
      "eventType": 18,
      "timestamp": "20161205T120459.319000"
    }
  ]
}

Space shortcuts

Page tree

Documentation for C-Werk 2.0.