Download SMB Audit Logs

Download logs of file and folder operations performed through the ECP Data Bridge SMB share.

• Sign in using an enabled ECP Data Bridge account.

• Identify the approximate time when the SMB operation occurred.

SMB audit logs are available from the ECP Data Bridge local UI. These logs are separate from the ECP Data Bridge application logs available through ECP.

1. Sign in to the ECP Data Bridge local UI.
2. Open Audit Logs.
   The available SMB audit-log files are displayed.
3. Locate the audit-log file that you want to review.
   The active log contains the most recent SMB events. Rotated log files contain earlier events.
4. For the required log file, select Download.
   The log file is downloaded to your system.
5. Open or extract the downloaded file.
6. Locate the entries associated with the operation that you want to review.
   Depending on the recorded operation, an entry can include:

   Information	Description
   Timestamp	The date and time when the SMB operation occurred.
   Username	The ECP Data Bridge account that performed the operation.
   Client IP address	The IP address of the system connected to the SMB share.
   Share	The SMB share through which the item was accessed.
   Action	The operation performed on the file or folder.
   File name and path	The file or folder affected by the operation.

7. Use the application logs instead when investigating application startup, configuration, authentication, or file-transfer processing. See Download ECP Data Bridge Application Logs.