EMC SourceOne Auditing and Reporting Version 7.0

Transcription

1 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide REV 01 EMC Corporation Corporate Headquarters: Hopkinton, MA

2 Copyright EMC Corporation. All rights reserved. Published April 2013 EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED AS IS. EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. All other trademarks used herein are the property of their respective owners. 2 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

3 Contents Contents... 3 Preface... 5 Chapter 1 Chapter 2 Auditing and Reporting Introduction Overview of auditing Overview of reporting Working with reports Installing EMC SourceOne Reporting SourceOne prerequisites Planning and installation checklist Pre-deployment planning Hardware and software requirements Installing SQL Server Reporting Services Configuring SQL Server Report Server Verifying installation of SQL Server Report Server Installing EMC SourceOne reports Installing EMC Discovery Manager reports Controlling access to EMC SourceOne and Discovery Manager reports Authenticating with the EMC SourceOne Activity database Authenticating with the EMC Discovery Manager database Configuring Internet Explorer for all EMC reports Maintaining the installation EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide 3

4 Contents Chapter 3 Chapter 4 Chapter 5 Chapter 6 Running EMC SourceOne Reports Accessing EMC SourceOne reports Mapped Folder Permissions Audit report Mapped Folder Effective Permissions report Specifying parameters for Search Audit reports (Search) Search Activity report (Search) Search Copy report (Search) Search Delete report (Search) Search Restore report (Search) Documents Copied report (Search) Documents Deleted report (Search) Documents Restored report (Search) Documents Viewed report (Search) Data Source Processing report Management Activity dashboard Search Activity dashboard SharePoint Management Activity Dashboard Files Management Activity Dashboard Running EMC Discovery Manager Reports Accessing Discovery Manager reports Search Activity report (Discovery Manager) Assign to Hold Folder report (Discovery Manager) Delete from Hold Folder report (Discovery Manager) Documents Viewed report (Discovery Manager) Export Activity report (Discovery Manager) Customizing Reports Changing parameter defaults Adding a company logo Troubleshooting Auditing and Reporting Troubleshooting EMC SourceOne auditing Troubleshooting EMC SourceOne reporting Index EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

5 Preface As part of an effort to improve and enhance the performance and capabilities of its product lines, EMC periodically releases revisions of its hardware and software. Therefore, some functions described in this document may not be supported by all versions of the software or hardware currently in use. For the most up-to-date information on product features, refer to your product release notes. If a product does not function properly or does not function as described in this document, please contact your EMC representative. Audience This document is part of the EMC SourceOne documentation set, and is intended for use by: EMC SourceOne Management system administrators who are processing , Microsoft SharePoint content, or file content, and who want to run reports on system processing statistics and audited SourceOne activities. EMC SourceOne Discovery Manager administrators and compliance officers who want to run reports on audited Discovery Manager operations. EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide 5

6 Preface Conventions used in this document EMC uses the following conventions for special notices. Note: A note presents information that is important, but not hazard-related.! CAUTION A caution contains information essential to avoid data loss or damage to the system or equipment.! IMPORTANT An important notice contains information essential to operation. Typographical conventions EMC uses the following type style conventions in this document: Normal Bold: Italic: Courier: Courier bold: Used in running (nonprocedural) text for: Names of interface elements (such as names of windows, dialog boxes, buttons, fields, and menus) Names of resources, attributes, pools, Boolean expressions, buttons, DQL statements, keywords, clauses, environment variables, filenames, functions, utilities URLs, pathnames, filenames, directory names, computer names, links, groups, service keys, file systems, notifications Used in running (nonprocedural) text for: Names of commands, daemons, options, programs, processes, services, applications, utilities, kernels, notifications, system call, man pages Used in procedures for: Names of interface elements (such as names of windows, dialog boxes, buttons, fields, and menus) What user specifically selects, clicks, presses, or types Used in all text (including procedures) for: Full titles of publications referenced in text Emphasis (for example a new term) Variables Used for: System output, such as an error message or script URLs, complete paths, filenames, prompts, and syntax when shown outside of running text Used for: Specific user input (such as commands) 6 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

7 Preface Courier italic: Used in procedures for: Variables on command line User input variables < > Angle brackets enclose parameter or variable values supplied by the user [ ] Square brackets enclose optional values Vertical bar indicates alternate selections - the bar means or { } Braces indicate content that you must specify (that is, x or y or z)... Ellipses indicate nonessential information omitted from the example Where to get help For EMC support, product, and licensing information, including documentation, go to: EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide 7

8 Preface Guide to using Adobe Reader with this document This document supports online reading using Adobe Reader version 7.0 or above. For optimal performance, you should download and install the latest free Adobe Reader version: ( Simplifying navigation This document uses hyperlinks to other relevant sections. You can simplify navigation by enabling an optional Web browser-like navigation feature in Adobe Acrobat Reader (version 7.0 or above): 1. On the Acrobat toolbar, right-click the Page Up or Page Down icon. Page Up Page Down 2. Click Show All Tools. The Previous View and Next View navigation buttons are displayed on your toolbar. Previous View Next View The Previous View and Next View navigation buttons function similar to your Web browser navigation buttons, enabling you to navigate between views using document hyperlinks. More information For more information about Adobe Reader navigation and other features, refer to the product help system. 8 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

9 4 Auditing and Reporting This chapter provides an overview of EMC SourceOne auditing and reporting, and includes the following topics: Introduction Overview of auditing Overview of reporting Working with reports Auditing and Reporting 9

10 Auditing and Reporting Introduction The following sections describe EMC SourceOne auditing and reporting features. What is audited? EMC SourceOne audits the following information: Changes to user permissions on mapped folders. Refer to Auditing of changes to user permissions on mapped folders on page 15. For SourceOne Search, all search operations that were performed using the Administrator search type, and if configured, selected search operations for specified users and document details. Refer to Auditing of SourceOne Search operations on page 12. For SourceOne Discovery Manager, all collection searches, documents viewed, assign to and delete from matter with hold folder operations, and exports. Refer to Auditing of Discovery Manager operations on page 16. Where is audit information stored? For SourceOne Search operations and mapped folder permissions, audit information is stored in the SourceOne Activity database. For the following SourceOne Discovery Manager operations, audit information is stored in the SourceOne Discovery Manager database: collection searches assign to matter with hold folder delete from matter with hold folder exports You can view audit information in EMC SourceOne reports and Discovery Manager reports. 10 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

11 Auditing and Reporting What audit reports are available? The following audit reports are available: Search Audit reports for SourceOne Search - Search Activity, Search Copy, Search Delete, Search Restore, Documents Copied, Documents Deleted, Documents Restored, Documents Viewed Search Audit reports for SourceOne Discovery Manager - Search Activity. Documents Viewed, Assign to Hold Folder, Delete from Hold Folder, and Export Activity Configuration reports - Mapped Folder Permissions Audit, Mapped Folder Effective Permissions What other reports are available? System processing reports are also available. Refer to System processing statistics on page 15. What are the prerequisites for reports? Install SQL Server Reporting Services 2008, 2008 R2, or 2012 and EMC SourceOne reports, as described in Installing EMC SourceOne Reporting on page 35. How do I run reports? EMC SourceOne administrators, legal users, and compliance officers can use Internet Explorer 7 or higher to access Microsoft SQL Server Reporting Services and run EMC SourceOne reports. Refer to: Running EMC SourceOne Reports on page 85 Running EMC Discovery Manager Reports on page 185 Introduction 11

12 Auditing and Reporting Overview of auditing Refer to: Auditing of SourceOne Search operations on page 12 Auditing of changes to user permissions on mapped folders on page 15 System processing statistics on page 15 Auditing of Discovery Manager operations on page 16 Auditing of SourceOne Search operations Refer to: Considerations for SourceOne Search auditing on page 12 About search roles on page 13 Considerations for SourceOne Search auditing Audited Search operations on page 13 Capturing document details on page 14 Auditing of SourceOne Search operations and mapped folder permissions is a go forward solution requiring upgrade to version 6.8 or later of EMC SourceOne Management. Previously executed Web Search operations will not have audit available. By design, auditing of search operations performed using the Administrator search type is on by default and cannot be turned off by the EMC SourceOne system administrator. Auditing of Administrator search result views is always enabled Auditing affects: System performance, as a result of additional processing required to store extra data Storage, as a result of storing additional data in the EMC SourceOne Activity database Reporting performance, as a result of generating reports against a growing volume of data stored in the EMC SourceOne Activity database 12 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

13 Auditing and Reporting Capturing document-level data for Administrator Copy To, Restore, or Delete operations may affect the performance of those operations. About search roles Auditing recognizes two search roles, based on the type of search that is performed in EMC SourceOne Search, as described in the following table. Table 1 Search roles and search types Search role recognized by auditing and reporting Search type in EMC SourceOne Search What is audited Administrator Administrator All searches performed using the Administrator search type are audited. Audited User My Items, My Contributed Items, All Items Searches performed using the My Items, My Contributed Items, or All Items search types are audited for a user only if the user is explicitly identified as an audited user. Typically, audited users are certain managers and executives who are required to have their searches audited. Refer to the EMC SourceOne Management Administration Guide, "Configuring Mapped Folders" for more information about search types and the associated permissions required on mapped folders. Note: An Administrator search role and a EMC SourceOne system administrator are distinct concepts and are not necessarily the same person. A EMC SourceOne system administrator cannot perform Administrator searches until he is granted Administrator permission on the mapped folders that he wants to search. Audited Search operations The following Search operations are always audited for the Administrator search role: Search View/preview search results Delete Restore Overview of auditing 13

14 Auditing and Reporting Copy To The following Search operations can be audited for the Audited User search role (specified users who use the My Items, My Contributed Items, or All Items search types): Search View/preview search results Delete Restore To configure auditing of search operations for audited users, refer to in the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. To view the audited information, run the following reports, described in Running EMC SourceOne Reports on page 85: Search Activity dashboard Search Activity report Search Copy report Search Delete report Search Restore report Capturing document details For the Administrator search role, you can choose to capture document details for the copy, delete, and restore operations performed in Search. Document views are always audited for the Administrator search role. For the Audited User search role, you can choose to capture document details for the delete and restore operations performed in Search. You can also choose to audit document views. The purpose of this level of audit is not to capture everything about the document but rather to capture enough information to identify the item and the intent of the operation performed on it. To configure auditing of document details, refer to in the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. To view the audited information, run the following reports, described in Running EMC SourceOne Reports on page 85: 14 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

15 Auditing and Reporting Documents Copied Documents Deleted Documents Restored Documents Viewed Auditing of changes to user permissions on mapped folders Changes to user permissions on EMC SourceOne mapped folders are always audited. No auditing configuration is required. To view the audited information, run the following reports, described in Running EMC SourceOne Reports on page 85: Mapped Folder Permissions Audit Mapped Folder Effective Permissions Note: Auditing of SourceOne mapped folder permissions is a go forward solution requiring upgrade to version 6.8 or later of EMC SourceOne Management. In the Mapped Folder Effective Permissions report, you can view permissions that were in effect at the time EMC SourceOne 6.8 was installed and for dates after installation, but not for dates before installation. System processing statistics System processing statistics are captured while the data is processed by a EMC SourceOne Management activity, and (if the components are installed) SharePoint activities and Files activities. System reports are for informational purposes only. The statistics are stored in the Activity database, and include the following information: Job ID Data source (such as the name of a mailbox) Mapped folder name Number and size of processed, duplicate, failed, and discarded items Note: Discarded means skipped or discarded due to applied filters or rules. Number and size of items with attachments Overview of auditing 15

16 Auditing and Reporting Size of the data source before and after processing System reports will show statistics for processing that occurred before EMC SourceOne 6.8 or later was installed. SharePoint and File data are captured starting with EMC SourceOne 7.0, EMC SourceOne for Microsoft SharePoint 7.0, and EMC SourceOne for File Systems 6.8. To view system processing information, run the following reports, described in Running EMC SourceOne Reports on page 85: Data Source Processing report Management Activity Dashboard SharePoint Management Activity Dashboard Files Management Activity Dashboard Auditing of Discovery Manager operations SourceOne audits: collection searches that are performed by Discovery Manager users with the Discovery Manager client or with the DMCollect utility assign to matter with hold folder operations delete from matter with hold folder operations documents viewed in the Collection Area, the Matter Review Area, the export Items tab, and the export Failures tab exports These operations are always audited. No auditing configuration is required. To view the audited information, run the appropriate Discovery Manager report, described in Running EMC Discovery Manager Reports on page 185. Considerations for SourceOne Discovery Manager auditing Auditing of Discovery Manager collection searches is a "go forward" solution requiring upgrade to version or later of both EMC SourceOne Management and EMC SourceOne Discovery Manager. Previously executed collection searches will not have audit available. 16 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

17 Auditing and Reporting Auditing of Discovery Manager operations (assign to hold folder, delete from hold folder, document views, export) is a "go forward" solution requiring upgrade to version 7.0 or later of both EMC SourceOne Management and EMC SourceOne Discovery Manager. Previously executed operations will not have audit available. By design, auditing is on by default and cannot be turned off by the EMC SourceOne system administrator or the Discovery Manager Application Administrator. Auditing affects: System performance, as a result of additional processing required to store extra data Storage, as a result of storing additional data in the EMC SourceOne Discovery Manager database Reporting performance, as a result of generating reports against a growing volume of data stored in the EMC SourceOne Discovery Manager database Audits may not be complete if connectivity is lost to the Discovery Manager database or the SourceOne Activity database. If the matter has a hold folder, then operations that assign items to a matter or remove items from a matter are audited. If the matter does not have a hold folder, then these operations are not audited because nothing is copied to or deleted from an archive folder. If a hold folder is associated with a matter after items were assigned to the matter, then the assigned items are automatically copied to the hold folder. This operation is audited. However, in this case, the person who associated the hold folder with the matter is audited as the user who performed the assign operation, instead of the person who originally assigned the items to the matter. Document-level auditing is captured for items viewed in the Collection Area, the Matter Review area, the export Items tab, and the export Failures tab of the Discovery Manager client. An audit occurs each time a document is viewed in a matter. If the same document is viewed multiple times, the view operation is audited each time. Document-level auditing is not captured for assign to hold folder operations and delete from hold folder operations. Overview of auditing 17

18 Auditing and Reporting Note: For reporting considerations and limitations, refer to Considerations and limitations for reports on page 19. Overview of reporting Refer to: Types of reports on page 18 Search roles for SourceOne Search reports on page 19 Prerequisites for SourceOne Search reports on page 19 Considerations and limitations for reports on page 19 Types of reports EMC SourceOne provides the following types of reports: Configuration reports - Display the auditing information captured for changes to user permissions on EMC SourceOne mapped folders. Refer to Table 5 on page 87 for a list of Configuration reports. Search Audit reports for SourceOne Search - Display the information captured for search operations and the documents processed in those operations, based on the auditing configuration. To configure auditing of search operations, refer to in the EMC SourceOne Management Administration Guide, Chapter 8, "Configuring Applications and Web Services" > Auditing Search operations. Refer to: Search roles for SourceOne Search reports on page 19 Prerequisites for SourceOne Search reports on page 19 Table 6 on page 88 for a list of Search Audit reports for SourceOne Search System reports - Display statistics about mailbox and PST processing, management activities, SharePoint activities, Files activities, and search activities for both Web Search and Discovery Manager. 18 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

19 Auditing and Reporting Refer to Table 7 on page 89 for a list of System reports. Search audit reports for SourceOne Discovery Manager - Displays information captured for collection searches, assign to matter with hold folder operations, delete from matter with hold folder operations, exports, and documents viewed. These operations are always audited. No configuration is required. Search roles for SourceOne Search reports The role of the search user is displayed in Search Audit reports and in the Search Activity dashboard. Auditing recognizes two search roles, based on the type of search that is performed in EMC SourceOne Search, as described in About search roles on page 13. Prerequisites for SourceOne Search reports To see information about user searches in reports, configure audited users. To see document details in Search Audit reports for restore, copy to, or delete operations, configure the appropriate Capture Document Details auditing option. Refer to the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Considerations and limitations for reports Refer to: General considerations on page 20 Considerations for SourceOne Search Audit reports on page 22 Considerations for Configuration reports on page 23 Considerations for System reports on page 23 Considerations for Discovery Manager reports on page 24 Overview of reporting 19

20 Auditing and Reporting General considerations Browser You must use Microsoft Internet Explorer 7.0 or higher to access EMC SourceOne reports. For more information, refer to Input of date and time in reports The input of date and time in report parameters depends on the regional settings of your SQL Server Reporting Services computer. Date parameter fields can accept times in any format including AM/PM. This ensures that time reporting is consistent and unambiguous across cultures and languages, especially for cultures that do not have an AM/PM designator. If you specify a time in the Data Source Processing report s Begin Date or End Date parameter, the time is ignored. The report displays an entire day s worth of data at minimum. Data for this report is captured and displayed at the daily level. Display of date and time in reports The times shown in EMC SourceOne Search Audit, Configuration, and System reports are based on the time zone in which the SQL Server resides that hosts the SourceOne Activity database, not the time zone of the client computer. The times shown in the Discovery Manager Search Activity report are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer. SQL Server does not store the daylight savings offset, so the time shown in reports does not adjust for daylight savings time. For example, if your SourceOne Activity database and Discovery Manager database reside on a SQL Server that is in the Eastern Time zone (GMT-05:00), and you enabled the "Automatically adjust clock for daylight savings changes" option in Windows Date and Time Properties, the reports display the time zone as GMT -4:00. The display of date and time is normalized to ISO/ODBC 24-hour format (YYYY-MM-DD HH:mm:ss) in all reports, including report data, the Report Configuration section, header, and footer. 20 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

21 Auditing and Reporting Tooltips dates do not use the 24-hour format, but use the regional settings format of the SQL Server Reporting Services computer instead. For weekly calculations, Monday is considered the first day of the week. Q1 is the January-to-March quarter. Default sorting of dates In Search Audit reports, the Date column is sorted in ascending order (oldest date first). This default sorting is intended to benefit users who want to view search audit history in chronological order. In Configuration reports, the Date column is sorted in descending order (newest date first). This default sorting is intended to benefit system administrators who want to view the latest changes. To change the sort order, click on the Date column header. English-only reports In this release, the reports are in English only. Navigation In drill through reports and in the Management Activity dashboard, when you select another period and then rerun the report, bread crumb links and the Report Manager link are not available for navigation. This is a limitation of Microsoft SQL Server Reporting Services. As a workaround, enable tabbed viewing in Internet Explorer so that you can navigate more easily between reports. I/O activity increases on SQL Server When you run an EMC SourceOne report, for a short time there can be significant I/O activity on the SQL Server that hosts the EMC SourceOne Activity database. When you run a Discovery Manager report, for a short time there can be significant I/O activity on the SQL Server that hosts the EMC SourceOne Discovery Manager database. The amount of I/O activity depends on: the audit records being requested for EMC SourceOne system reports, the amount of historical data in the Activity database When you refresh a report, database I/O activity may occur. Overview of reporting 21

22 Auditing and Reporting Considerations for SourceOne Search Audit reports SourceOne Search Audit reports display go forward data SourceOne Search Audit reports display information that is captured after EMC SourceOne 6.8 or later is installed and after the auditing of search operations is configured. Sender information in Search Delete reports For Search Delete reports, the Sender information is captured for audit purposes only if the From column is included in the search results. Refer to Setting preferences in the EMC SourceOne Search User Guide. Document-level auditing Auditing information for a document view or preview by a user is captured the first time the document is viewed or previewed by that user in a EMC SourceOne search. If the document is viewed or previewed again in the same search, the information is not captured again. This behavior is by design, to prevent duplicate information from filling the database. If the same document is accessed in a different search, then another audit is recorded. If document-level auditing is enabled, and a user views or previews a document during a Copy To or Restore operation in Search, then EMC SourceOne captures additional document information that was not captured during the Copy To or Restore operation. Multi-select deletes You may see different audit details in reports involving a multi-select delete. Typically, the user views or previews a document before deleting it, so there may be two or more document view audits (if enabled) before a multi-select deletion. Document view audits usually audit more precise document details than delete audits, due to the source of the information. Therefore, if a document is audited in a view operation and then deleted, there may be more complete or different information recorded in the document view audit than is recorded in the delete audit. If the document has already been audited for some other reason before the deletion occurs, then the deletion will not overwrite the document details in the database. Documents that were not audited before the deletion may have different information recorded in the database compared to documents that were audited for another reason (for example, being viewed). 22 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

23 Auditing and Reporting Copy To operations and Restore operations In a Search Copy report and in a Search Restore report: If a Copy To or Restore operation fails during the retrieval of an item, then no audit information is captured. The item is reported in neither the Audited column nor the Copied/Restored column. If a Copy To or Restore operation succeeds during the retrieval of an item but the copy or restore fails, then the audit information is captured. The item is reported in the Audited column. However, because the copy or restore failed, the item is not reported in the Copied/Restored column. If a Copy To or Restore operation succeeds during the retrieval of an item and succeeds during the copy or restore, then the audit information is captured. The item is reported in both the Audited column and in the Copied/Restored column. Considerations for Configuration reports Configuration reports display go forward data captured after EMC SourceOne 6.8 or later is installed. Considerations for System reports The Data Source Processing report, Management Activity Dashboard, SharePoint Management Activity Dashboard, and Files Management Activity Dashboard are not audit reports, and are informational only. The Data Source Processing report and the Management Activity Dashboard will show information for content that was captured in the Activity database before EMC SourceOne 6.8 or later was installed. The SharePoint Management Activity Dashboard report is available if EMC SourceOne for Microsoft SharePoint 7.0 or later is installed on your SourceOne 7.0 or later system. The Files Management Activity Dashboard report is available if EMC SourceOne for File Systems 6.8 or later is installed on your SourceOne 7.0 or later system. The first row in the Management Activity Dashboard, SharePoint Management Activity Dashboard, and Files Management Activity Dashboard may display zeroes (0) for all columns. This is a known issue. Overview of reporting 23

24 Auditing and Reporting Considerations for Discovery Manager reports Discovery Manager reports display go forward data Discovery Manager Search Activity reports display information that is captured after EMC SourceOne and Discovery Manager are installed. The auditing of Discovery Manager search operations is separate from the auditing of SourceOne Search operations Discovery Manager Assign to Hold Folder, Delete from Hold Folder, Documents Viewed, and Export Activity reports display information that is captured after EMC SourceOne 7.0 and Discovery Manager 7.0 are installed. These Discovery Manager operations are always audited. No auditing configuration is required. Considerations for Discovery Manager Search Activity report The Archive Hits column displays the number of items found in the archive, including duplicates, that matched collection search criteria. This count may not match the number of items displayed in Discovery Manager search results. By design: Discovery Manager deduplicates search results, and only lists a single instance for each message in results. Re-running a Discovery Manager search produces differential search result sets. For successive runs of the same search, Discovery Manager lists only messages that were not found in the previous run. The maximum number of results a user gets depends on whether the user specifies a Maximum Search Results value that is less than, greater than, or an exact multiple of 5,000 (the internal batch size used to put search results into the database). For more information, refer to "Behavior of Maximum Search Hits (Maximum Search Results)" in the EMC SourceOne Discovery Manager User Guide. Considerations for Discovery Manager Assign to Hold Folder report Assign to hold folder operations can encounter duplicates in two situations: The item was found in multiple mapped folders during search. 24 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

25 Auditing and Reporting The item is already in the hold folder because the same item was selected again to be assigned or multiple matters share the same hold folder. If an item is found in multiple mapped folders during search, it only appears once in search results in the Discovery Manager client, but each occurrence is counted in the audit record. Considerations for Discovery Manager Delete from Hold Folder report Items that display a Copy Failed status in Discovery Manager will be audited when they are deleted from a matter only if a hold folder is associated with the matter. Considerations for Discovery Manager Documents Viewed report A document can be viewed in the Collection Area, the Matter Review area, the export Items tab, and the export Failures tab of the Discovery Manager client. An audit is captured each time a document is viewed in these areas. The Documents Viewed report indicates the area in which the document was viewed. If a document was viewed in the Collection Area, then the Documents Viewed report includes an Associated Search Details section. If a document was viewed in the Matter Review area, the export Items tab, or the export Failures tab, then the Documents Viewed report does not include an Associated Search Details section. Overview of reporting 25

26 Auditing and Reporting Working with reports This section describes the features common to all SourceOne reports, except as noted. Refer to: Display features in EMC SourceOne and Discovery Manager reports on page 26 Using the report toolbar on page 30 Display features in EMC SourceOne and Discovery Manager reports Refer to: Maximum row count warning on page 26 Expanding sections and rows on page 27 Tooltips on page 28 Displaying GMT date and time on page 28 Report Configuration section on page 28 Maximum row count warning If a report returns more rows than are specified by the hidden MaxRowCount parameter: The report displays the maximum number of rows. A warning is displayed at the top of the report, for example: Figure 1 Maximum row count exceeded Note: (The warning is not displayed for the Mapped Folder Effective Permissions report, the Management Activity dashboard, and the Search Activity dashboard.) To change the value of the MaxRowCount parameter for a report, refer to Chapter 8, Customizing Reports. 26 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

27 Auditing and Reporting Expanding sections and rows By default in Search Audit reports, the Expand All Groups parameter is set to False, so sections and rows are not expanded in reports. To expand one section or row, click the plus sign (+) next to the section or row. To expand all sections and rows, before you run the report select the Expand All Groups: True option in the report parameters area. Figure 2 Example - Report Configuration section, Search Activity report (Search) Figure 3 Example - Report Configuration section, Search Activity report (Discovery Manager) Figure 4 Example - Search Details, Search Activity report (Search) Working with reports 27

28 Auditing and Reporting To change the Expand All Groups default to True, refer to Chapter 8, Customizing Reports. Tooltips Tooltips are displayed at various places in reports, such as on graphs and links. Displaying GMT date and time To display the GMT date and time in SourceOne Search Audit reports and Discovery Manager Search Activity reports, hover the mouse over the date. Figure 5 GMT date and time Report Configuration section The following reports include a Report Configuration section, described in Table 2: SourceOne reports: Search Audit reports, Configuration reports, and the Data Source Processing report Discovery Manager Search Audit reports For examples of Report Configuration sections, refer to Figure 2 on page 27 and Figure 3 on page 27.. Table 2 Report Configuration section Parameter Duration/Date Effective Date Mapped Folder Description (SourceOne Search Audit reports and Data Processing reports; Discovery Manager Search Audit reports) The label depends on how you specified a date: Duration: The option that you selected for the Period parameter. Date: The date range that you specified in the Begin Date and End Date parameters. (SourceOne Configuration reports) The date you specified for the Date parameter. The effective date displayed in the reports reflects the date that you specified, which does not directly correspond with the value used in the SQL query. If you specify a date without a time, then the date is modified to the end of the day, rather than the start. The effective date shown in the report is left as is, to reflect your ntent rather than the internal processing. (SourceOne Configuration reports) The folder you specified for the Mapped Folder parameter. 28 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

29 Auditing and Reporting Table 2 Report Configuration section (continued) Parameter Folder User User Matter Description (SourceOne Configuration reports) The user you specified for the Folder User parameter. (SourceOne Search Audit reports; Discovery Manager Search Audit reports) The option that you selected for the User parameter. (Discovery Manager Search Audit reports) The matter you selected for the Matter parameter. Max Row Count The maximum number of rows in the report. The default is To change this value, refer to Chapter 8, Customizing Reports. Execution Time Executed By Report Time Zone The date and time on which this report ran. The login of the user who ran this report. For SourceOne reports, the time zone in which the SQL Server resides that hosts the SourceOne Activity database. For Discovery Manager reports, the time zone in which the SQL Server resides that hosts the Discovery Manager database. Working with reports 29

30 Auditing and Reporting Using the report toolbar Use the report toolbar to navigate, search, export, and print reports. Figure 6 Report toolbar - SQL 2008 R2 Figure 7 Report toolbar - SQL 2008 Refer to: Navigating reports on page 30 Searching reports on page 30 Adjusting display of reports on page 31 Exporting reports on page 31 Printing reports on page 32 Navigating reports Use the arrow buttons in the report toolbar to navigate a multi-page report. Report toolbar - navigation First page Previous page Next page Last page To go directly to a specific page, type the page number in the text box, then press Enter. Searching reports To search a report: 1. In the report toolbar, type a search string in the text box. 30 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

31 Auditing and Reporting Figure 8 Example - Report toolbar - search string Adjusting display of reports 2. Click Find. 3. To go to the next occurrence of the search string, click Next. To adjust the display of reports onscreen, select a zoom factor (magnification percent) in the report toolbar. Figure 9 Report toolbar - zoom Exporting reports Introduction By default, reports are generated in HTML format. You can export a report in a variety of formats: PDF MHTML (web archive) Excel TIFF file Word Note: Although XML and CSV export formats are available in Reporting Services, in this release, export of EMC SourceOne reports to XML and CSV is not supported. The report is exported as displayed onscreen; sections and groups that are not expanded onscreen will remain unexpanded when exported. Graphs are exported to PDF, MHTML, TIFF, and Word as displayed onscreen. Procedure To export a report: Working with reports 31

32 Auditing and Reporting 1. If you want sections or groups to display as expanded in the exported format, you must expand them onscreen. 2. For SQL 2008 R2: a. Click the dropdown arrow next to the Export icon. b. Select an export format. c. Click the Export icon. Figure 10 SQL 2008 R2 - Export icon 3. For SQL 2008: a. In the field next to the Export button in the report toolbar, select an export format. b. Click Export. Printing reports! IMPORTANT Use the report toolbar to print reports. If you use your browser s Print icon or File > Print instead, reports will not print correctly. The report is printed as displayed onscreen; sections and groups that are not expanded onscreen will remain unexpanded when printed. Graphs are printed as displayed onscreen. To print a report: 1. Click the Print icon in the report toolbar. Figure 11 Report toolbar SQL 2008 R2 - Print icon 32 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

33 Auditing and Reporting Figure 12 Report toolbar SQL Print icon 2. The first time you print a report: You may see the following message and dialog box: a. Click OK to close the dialog box. b. Click the message to allow the download of the ActiveX control. You will see the following dialog box: Click Install to install the client print control. 3. In the Print dialog box, specify print options. Working with reports 33

34 Auditing and Reporting 34 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

35 5 Installing EMC SourceOne Reporting EMC SourceOne Reporting is an optional feature in EMC SourceOne Management. This chapter describes how to install components of EMC SourceOne Reporting, and includes the following topics: SourceOne prerequisites Planning and installation checklist Pre-deployment planning Hardware and software requirements Installing SQL Server Reporting Services Configuring SQL Server Report Server Verifying installation of SQL Server Report Server Installing EMC SourceOne reports Installing EMC Discovery Manager reports Controlling access to EMC SourceOne and Discovery Manager reports 76 Authenticating with the EMC SourceOne Activity database Authenticating with the EMC Discovery Manager database Configuring Internet Explorer for all EMC reports Maintaining the installation Note: This document uses hyperlinks to other relevant sections. You can simplify navigation by enabling an optional web browser-like navigation feature in Adobe Acrobat Reader (version 7.0 or above). For details, see Guide to using Adobe Reader with this document on page 8. Installing EMC SourceOne Reporting 35

36 Installing EMC SourceOne Reporting SourceOne prerequisites Before you install SourceOne reports, ensure that the following prerequisites have been met. For all reports, and to support the Discovery Manager, SourceOne for File Systems, and SourceOne for Microsoft SharePoint add-on components: SourceOne Management 7.0 must be installed. SourceOne 7.0 databases must reside on supported versions of SQL Server. For Discovery Manager reports: SourceOne Discovery Manager 7.0 must be installed. The Discovery Manager 7.0 database must reside on supported versions of SQL Server. For File reports, SourceOne for File Systems 6.8 must be installed. For SharePoint reports, SourceOne for Microsoft SharePoint 7.0 must be installed. 36 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

37 Installing EMC SourceOne Reporting Planning and installation checklist EMC SourceOne Reporting provides two sets of reports: EMC SourceOne reports include Search Audit reports for SourceOne Search, Configuration reports, and System reports. Discovery Manager reports include Search Audit reports for SourceOne Discovery Manager collection searches, assign to hold folder operations, delete from hold folder operations, documents viewed, and exports. Use the following checklist to plan and install EMC SourceOne Reporting. Table 3 Checklist: Planning and installing EMC SourceOne Reporting Activity Perform pre-deployment planning. Review SQL Server requirements, considerations and limitations and high availability requirements. Review hardware and software requirements for supported versions of Microsoft SQL Server Reporting Services and client host computers. Review software requirements for the EMC SourceOne Reporting client computer. Refer to Considerations and limitations on page 39. Requirements for the report server on page 41. Requirements for the report client on page 42 Install SQL Server Reporting Services. Installing SQL Server Reporting Services on page 43. Configure SQL Server Report Server. Configuring SQL Server Report Server on page 52. Verify the installation of SQL Server Report Server. Verifying installation of SQL Server Report Server on page 67. Install the EMC SourceOne Reports on the SQL Server Report Server. Install the EMC Discovery Manager Reports on the SQL Server Report Server. Installing EMC SourceOne reports on page 68. Installing EMC Discovery Manager reports on page Set access permissions for EMC SourceOne reports. Controlling access to EMC SourceOne and Discovery Manager reports on page 76. Planning and installation checklist 37

38 Installing EMC SourceOne Reporting Table 3 Checklist: Planning and installing EMC SourceOne Reporting Activity Refer to Set access permissions for Discovery Manager reports. Controlling access to EMC SourceOne and Discovery Manager reports on page 76. Configure Internet Explorer on client computers. Configuring Internet Explorer for all EMC reports on page 83. Configure EMC SourceOne auditing. Note: This step applies to the auditing of SourceOne Search operations. It does not apply to Discovery Manager auditing, which is always enabled. "Configuring Applications and Web Services" > "Auditing search operations" in the EMC SourceOne Administration Guide. 38 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

39 Installing EMC SourceOne Reporting Pre-deployment planning Before you install EMC SourceOne Reporting, review the following sections: SQL Server Reporting Services requirement on page 39 Considerations and limitations on page 39 High availability of SQL Server Reporting Services on page 40 SQL Server Reporting Services requirement EMC SourceOne Reporting requires supported versions of Reporting Services. Refer to Microsoft for information about license costs. The SQL Server Report Server can be installed on the same computer as the SourceOne production databases, as indicated by the dotted line in Figure 13. Figure 13 Server and client configuration for EMC SourceOne Reporting Considerations and limitations Review the following considerations and limitations before you install EMC SourceOne reporting. Performance Some of the EMC SourceOne production databases are also used for reporting: The EMC SourceOne Activity production database is also used for the EMC SourceOne reports. The EMC SourceOne Discovery Manager production database is also used for the Discovery Manager reports. Pre-deployment planning 39

40 Installing EMC SourceOne Reporting Performance is affected by the increased number of database calls and increased disk space usage due to additional auditing. System reports require increased I/O operation. Scalability If the EMC SourceOne Activity database and the EMC SourceOne Discovery Manager database are hosted on the Enterprise edition of SQL Server, then some of the database tables that store auditing information are partitioned automatically to improve the scalability of auditing. No action is required by the SQL Server database administrator. Note: Partitioning settings are available in Discovery Manager. Refer to the EMC SourceOne Discovery Manager User Guide. Languages Internet Explorer language settings affect the text generated by SQL Server Reporting Server. However, in this release, the text in EMC SourceOne reports and Discovery Manager reports is displayed in English only. High availability of SQL Server Reporting Services SQL Server Reporting Services cannot be clustered. You can install a separate instance of Reporting Services, as described in Microsoft documentation for scale-out deployment. 40 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

41 Installing EMC SourceOne Reporting Hardware and software requirements This section includes the following topics: Requirements for the report server on page 41 Requirements for the report client on page 42 Note: Refer to Microsoft SQL Server Reporting Services documentation for additional requirements. Requirements for the report server EMC SourceOne reports and Discovery Manager reports are produced using Microsoft SQL Server Reporting Services (SSRS). You can install Microsoft SQL Server Reporting Services on the same computer as the SourceOne production databases, as long as all hardware and software requirements for Reporting Services are met. However, running reports against a large data set (such as the EMC SourceOne database or the Discovery Manager database) takes processor time away from the operation of EMC SourceOne or Discovery Manager. The ingestion rate or the performance of other EMC SourceOne operations may be affected when the databases and Microsoft Report Server are on the same computer. For performance reasons, you may want to install Microsoft Report Server on a separate computer. Refer to the following topics: Hardware requirements for the report server on page 41 Software requirements for the report server on page 42 Login requirements for installation of the report server on page 42 Hardware requirements for the report server The server on which you plan to install Microsoft SQL Server for use with EMC SourceOne Reporting must meet Microsoft s minimum or recommended hardware requirements. Refer to Microsoft documentation. Hardware and software requirements 41

42 Installing EMC SourceOne Reporting Software requirements for the report server The SQL Server server used for EMC SourceOne Reporting requires the following software: Windows Server 2003 or Windows Server 2008 SQL Server supported version; Standard or Enterprise License.NET Framework (installed as part of the SQL Server Reporting Server) Login requirements for installation of the report server You must install SQL Server Reporting Services using an account with local administrator privileges on the computer. Requirements for the report client The client computer used to access EMC SourceOne reports and Discovery Manager reports requires: Internet Explorer to access EMC SourceOne reports and Discovery Manager reports over the intranet through a browser. Recommended: Enable tabbed viewing in Internet Explorer so that you can navigate more easily between reports. Refer to the EMC SourceOne for supported browsers. Note: After installing EMC SourceOne reports and Discovery Manager reports, add the Report Manager URL to Internet Explorer s Local Intranet zone, as described in Configuring Internet Explorer for all EMC reports on page 83. Adobe Acrobat Reader to view and print EMC SourceOne reports and Discovery Manager reports in PDF format. Minimum screen resolution of 1024x768 for standard size monitors, or the equivalent for wide-screen monitors 42 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

43 Installing EMC SourceOne Reporting Installing SQL Server Reporting Services This section describes a single-server, default instance deployment of SQL Server Reporting Services. The Report Server and the Report Server database are installed on the same computer. For information on planning, installing, and configuring Reporting Services for a scale-out deployment, refer to Microsoft documentation. This procedure assumes that you are adding the Reporting Services feature to an existing instance of SQL Server with the Database Engine already installed, as shown in Figure 16. To install SQL Server Reporting Services, on the SQL Server that will be used for EMC SourceOne reports: 1. Log in using an account with local administrator privileges on the computer. 2. Run the SQL Server setup program. 3. In the SQL Server Installation Center, click New installation or add features to an existing installation. Figure 14 SQL Server Installation Center The Setup Support Rules page displays information about your system. 4. Click Next. 5. On the Installation Type page, select Add features to an existing instance of SQL Server 2008/2008 R2, then select the name of the instance from the dropdown list. Installing SQL Server Reporting Services 43

44 Installing EMC SourceOne Reporting Figure 15 Installation Type 6. Click Next. 7. On the Feature Selection page, select following features: Reporting Services Management Tools - Complete Note: The checkboxes for features that were installed previously are selected by default and are grayed out. 44 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

45 Installing EMC SourceOne Reporting Figure 16 Feature Selection - SQL Server Click Next. 9. The Disk Space Requirements page reports the total disk space available and the total disk space required. Verify that you have enough disk space for the installation. Figure 17 Disk Space Requirements 10. Click Next. Installing SQL Server Reporting Services 45

46 Installing EMC SourceOne Reporting 11. On the Server Configuration page, specify the service accounts (names and passwords) for the Reporting Services and any other SQL Server services you installed. Microsoft recommends using the Network Service account. Figure 18 Server Configuration 12. Click Next. 46 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

47 Installing EMC SourceOne Reporting 13. On the Reporting Services Configuration page, select the Install, but do not configure the report server option for both existing and new installations. Figure 19 Reporting Services Configuration 14. Click Next. Installing SQL Server Reporting Services 47

48 Installing EMC SourceOne Reporting 15. On the Error and Usage Reporting page, leave the default settings. Figure 20 Error and Usage Reporting - SQL Server 2008 Figure 21 Error and Usage Reporting - SQL Server 2008 R2 48 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

49 Installing EMC SourceOne Reporting 16. Click Next. 17. The Installation Rules page (SQL Server 2008) or the Installation Configuration Rules page (SQL Server 2008 R2) indicates whether or not the installation is ready to proceed. The status of all items should be Passed or Not Applicable. Figure 22 Installation Rules - SQL Server 2008 Installing SQL Server Reporting Services 49

50 Installing EMC SourceOne Reporting Figure 23 Installation Configuration Rules - SQL Server 2008 R2 18. Click Next. 50 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

51 Installing EMC SourceOne Reporting 19. The Ready To Install page lists the installation information that you supplied. Verify that the information is correct. If it is not correct, edit the information on the appropriate page of the installation wizard. Figure 24 Ready To Install 20. When you are ready to proceed with the installation, click Install. The Installation Progress page indicates the progress of the installation. The Complete page indicates that the installation completed successfully. 21. Click Close. Installing SQL Server Reporting Services 51

52 Installing EMC SourceOne Reporting Configuring SQL Server Report Server! IMPORTANT Configure the options in the Reporting Services Configuration Manager window in the sequence shown in the left pane. Doing so ensures that each configuration screen is populated correctly. To configure SQL Server Report Server: 1. On the Start menu, select Start > All Programs > Microsoft SQL Server version > Configuration Tools > Reporting Services Configuration Manager. 2. Continue to each of the following steps, in the order given: Step 1: Connect to the Report Server instance on page 52 Step 2: Specify the service account on page 53 Step 3: Specify the Web Service URL on page 54 Step 4: Specify information about the Reporting Server database on page 55 Step 5: Specify the Report Manager URL on page 61 Step 6: Use defaults for Settings on page 63 Step 7: Use defaults for Execution Account on page 63 Step 8: Specify backup information for the encryption key on page 64 Step 9: Use defaults for Scale-out Deployment on page 66 Step 1: Connect to the Report Server instance The Reporting Services Configuration Connection dialog box displays the name of the server running Report Server and the name of the instance of Report Server. 1. You can edit the information. 2. Click Connect to connect to the specified Report Server instance. 52 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

53 Installing EMC SourceOne Reporting Figure 25 Reporting Services Configuration Connection - SQL Server 2008 Figure 26 Reporting Services Configuration Connection - SQL Server 2008 R2 Step 2: Specify the service account Microsoft recommends changing the Reporting Services service account through SQL Server Reporting Services Configuration Manager, not through the service console. To specify the service account: 1. In the left pane of the Reporting Services Configuration Manager window, click Service Account. 2. Select the Use built-in account option. 3. Select Network Service from the dropdown list. Configuring SQL Server Report Server 53

54 Installing EMC SourceOne Reporting Figure 27 Service Account - Use built-in account 4. Click Apply. Step 3: Specify the Web Service URL To specify the Web Service URL: 1. In the left pane of the Reporting Services Configuration Manager window, click Web Service URL. 2. The right pane displays the default values for the Report Server Web Service. Leave the default settings. 54 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

55 Installing EMC SourceOne Reporting Figure 28 Web Service URL 3. Click Apply. The Results pane indicates the progress of URL creation.! IMPORTANT Make a note of the Report Server Web Service URL shown at the bottom of the right pane. You need this URL when you install EMC SourceOne reports and Discovery Manager reports later. Step 4: Specify information about the Reporting Server database SQL Server Reporting Server uses its own report database for internal processing of reports and other catalog information. This is not a EMC SourceOne database. To specify information about the Reporting Server database: 1. In the left pane, click Database. Configuring SQL Server Report Server 55

56 Installing EMC SourceOne Reporting 2. In the right pane, click Change Database. Figure 29 Report Server Database The Change Database dialog box opens. 3. Continue to each of the following steps, in the order given: Step 4A: Change Database - Action page on page 56 Step 4B: Change Database - Database Server page on page 57 Step 4C: Change Database - Database page on page 58 Step 4D: Change Database - Credentials page on page 59 Step 4E: Change Database - Summary page on page 60 Step 4F: Change Database - Progress and Finish page on page 61 Step 4A: Change Database - Action page 1. On the Action page of the Change Database dialog box, select the Create a new report server database option. 56 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

57 Installing EMC SourceOne Reporting Figure 30 Change Database - Action 2. Click Next. Step 4B: Change Database - Database Server page On the Database Server page of the Change Database dialog box: 1. In the Server Name field, specify the name of the server running SQL Server Database Engine. 2. In the Authentication Type field, select Current user - Integrated Security. The Username field displays the name of the account that has permission to connect to the SQL Server Database Engine. You specified this account when you installed the Database Engine. 3. Click Test Connection to verify that the specified account can connect to the Database Engine. Configuring SQL Server Report Server 57

58 Installing EMC SourceOne Reporting Figure 31 Change Database - Database Server 4. Click Next. Step 4C: Change Database - Database page On the Database page of the Change Database dialog box: 1. Specify the name of the Report Server database. The default is ReportServer. 2. The language you specify for the reports database affects the names of roles and other internal features that an administrator sees when managing the database. It does not affect EMC SourceOne reports. In the Language field, select the appropriate language. 3. For Report Server Mode, select the Native Mode option. 58 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

59 Installing EMC SourceOne Reporting Figure 32 Change Database - Database 4. Click Next. Step 4D: Change Database - Credentials page 1. On the Credentials page of the Change Database dialog box, in the Authentication Type field, select Service Credentials (default). This is the account that the Report Server will use to connect to the Report Server database, using the same credentials as the Reporting Service. The User name and Password fields display the credentials of the service account for Reporting Services that you specified during installation. Note: The Windows Credentials option connects using the specified credentials for a particular Windows user. Select this option if the default Service Credentials option is not appropriate. The SQL Server Credentials option is not recommended. Configuring SQL Server Report Server 59

60 Installing EMC SourceOne Reporting Figure 33 Change Database - Credentials 2. Click Next. Step 4E: Change Database - Summary page The Summary page of the Change Database dialog box lists the configuration information that you supplied. 1. Verify that the information is correct. If it is not correct, edit the information on the appropriate page of the Change Database wizard. Figure 34 Change Database - Summary 60 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

61 Installing EMC SourceOne Reporting 2. Click Next. Step 4F: Change Database - Progress and Finish page The Progress and Finish page of the Change Database dialog box indicates the progress of the configuration, and then indicates that the installation completed successfully. Click Complete. Step 5: Specify the Report Manager URL The Report Manager URL will be used to access the EMC SourceOne reports and Discovery Manager reports. To specify the Report Manager URL: 1. In the left pane of the Reporting Services Configuration Manager window, click Report Manager URL. 2. The right panel displays the URL to access Report Manager, based on information you supplied. You can edit the default value for the virtual directory. To edit other parameters, click Advanced. 3. Click Apply. The Results pane indicates the progress of URL creation. Configuring SQL Server Report Server 61

62 Installing EMC SourceOne Reporting Figure 35 Report Manager URL! IMPORTANT Make a note of the URL shown in the right pane. This is the URL that you will use to access EMC SourceOne reports and Discovery Manager reports. 4. Click the URL to verify that you can access the Report Manager home page. Figure 36 Report Manager home page 62 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

63 Installing EMC SourceOne Reporting Step 6: Use defaults for Settings Use the defaults for settings: 1. In the left pane of the Reporting Services Configuration Manager window, click Settings. 2. In the right pane, leave the default settings for . Figure 37 Settings Step 7: Use defaults for Execution Account To use the defaults for Execution Account: 1. In the left pane of the Reporting Services Configuration Manager window, click Execution Account. 2. In the right pane, leave the default settings for the execution account. Configuring SQL Server Report Server 63

64 Installing EMC SourceOne Reporting Figure 38 Execution Account Step 8: Specify backup information for the encryption key To specify backup information for Reporting Services encryption key: 1. In the left pane of the Reporting Services Configuration Manager window, click Encryption Keys. 2. In the right pane, click Backup. 64 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

65 Installing EMC SourceOne Reporting Figure 39 Encryption Keys 3. In the Backup Encryption Key dialog box, specify the security password and file to backup your Report Server encryption key. a. In the File Location field, either type a new pathname or click the browse button and select an existing encryption key file. b. In the Password field, type the password for the encryption key. c. In the Confirm Password field, retype the password. The encryption file and password are used to save the encrypted information (such as credentials) stored in Report Server. This information is required in case Report Server becomes corrupt and needs to be restored with a re-install. Figure 40 Backup Encryption Key Configuring SQL Server Report Server 65

66 Installing EMC SourceOne Reporting 4. Click OK to close the Backup Encryption Key dialog box. Step 9: Use defaults for Scale-out Deployment Use the defaults for Scale-out Deployment: 1. In the left pane of the Reporting Services Configuration Manager window, click Scale-out Deployment. 2. The right pane displays information about the Report Server. Figure 41 Scale-out Deployment 3. Click Exit to close the Reporting Services Configuration Manager window. 66 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

67 Installing EMC SourceOne Reporting Verifying installation of SQL Server Report Server Use one of the following methods to verify the installation of SQL Server Report Server: In Reporting Services Configuration Manager, click the URL link described in Step 5: Specify the Report Manager URL on page 61. Outside of Reporting Services Configuration Manager, follow these steps on the Report Server. Repeat the procedure on a client computer. 1. Start Internet Explorer. 2. Enter the Report Manager URL. (This is the URL shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.) Note: It may take a few minutes to access the URL, and it may appear that the access operation has hung. SQL Server Reporting Services flushes its cache if it is inactive for 20 minutes. 3. Verify that you see the SQL Server Reporting Services Home page. You have completed installing and configuring SQL Server Reporting Services. Verifying installation of SQL Server Report Server 67

68 Installing EMC SourceOne Reporting Installing EMC SourceOne reports This section describes the prerequisites and procedures for installing EMC SourceOne reports. Prerequisites Ensure the following prerequisites are completed: Install and configure SQL Server Reporting Services, as described earlier in this chapter. Verify that the SQL Server Reporting Services web service is ready by browsing to the Web Service URL. (This is the URL shown on the Web Service URL page of SQL Server Reporting Services Configuration Manager.) If you attempt to install EMC SourceOne reports before this web service is ready, then the installation may time out. The SourceOne Reports setup program includes reports for EMC SourceOne for Microsoft SharePoint. If EMC SourceOne for Microsoft SharePoint is not installed on your SourceOne system, then the SourceOne Reports setup program will skip the installation of the SharePoint reports and and will not report an error. The SourceOne Reports setup program includes reports for EMC SourceOne for File Systems. If EMC SourceOne for File Systems is not installed on your SourceOne system, then the SourceOne Reports setup program will skip the installation of the Files reports and will not report an error. Procedure In the EMC SourceOne Management kit, the SourceOne Reports setup program (ES1_Reports_Setup.bat) is located in: ES1_CDRom\Setup\Reporting\EMC SourceOne To install EMC SourceOne reports, on the SQL Server 2008, 2008 R2, or 2012 Report Server: 1. Log on with local administrator privileges on the computer. 2. Open a command window. 68 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

69 Installing EMC SourceOne Reporting 3. Run ES1_Reports_Setup.bat. 4. At the following prompt, specify the SQL Server that hosts the EMC SourceOne Activity database. Specify the IP address or the server name, or press Enter to accept the default (localhost). Specify SQL Server for Activity database <default:localhost>: 5. At the following prompt, specify the name of the EMC SourceOne Activity database. Specify Activity Database Name: 6. At the following prompt, specify the URL of the Report Server Web Service. It is not necessary to include the port number. Specify Report Server Web Service URL: This URL must be the same one that you configured on the Web Service URL page in Reporting Services Configuration Manager. Figure 42 Example - Web Service URL Note: Do not specify the Report Manager URL. 7. At the View log file? <Y/N default:n> prompt, do one of the following steps: If you want to view the log file, press Y. Installing EMC SourceOne reports 69

70 Installing EMC SourceOne Reporting If you do not want to view the log file, press N, or press Enter to accept the default (N). Figure 43 Running ES1_Reports_Setup.bat If the installation is successful, then you see messages confirming the installation of each report. If an error occurs during installation, then you see an error message. The following example shows the error message displayed when you enter an incorrect URL. Figure error due to incorrect URL Verify report installation To verify that the reports were installed: 1. Start Internet Explorer. 2. Enter the Report Manager URL. (This is the URL shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.) Note: It may take a few minutes to access the URL, and it may appear that the access operation has hung. SQL Server Reporting Services flushes its cache if it is inactive for 20 minutes. 3. Verify that the SQL Server Reporting Services home page displays the EMC SourceOne folder. 70 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

71 Installing EMC SourceOne Reporting Figure 45 EMC SourceOne folder 4. Click the EMC SourceOne folder to open it, and verify that it contains the following subfolders: Configuration Reports Search Audit Reports System Reports Figure 46 EMC SourceOne reports subfolders Installing EMC SourceOne reports 71

72 Installing EMC SourceOne Reporting Installing EMC Discovery Manager reports This section describes the prerequisites and procedures for installing EMC Discovery Manager reports. Prerequisites Ensure the following prerequisites are completed: Install and configure SQL Server Reporting Services, as described earlier in this chapter. Verify that the SQL Server Reporting Services web service is ready by browsing to the Web Service URL. (This is the URL shown on the Web Service URL page of SQL Server Reporting Services Configuration Manager.) If you attempt to install EMC Discovery Manager reports before this web service is ready, then the installation may time out. Procedure In the EMC SourceOne Management kit, the Discovery Manager Reports setup program (ES1_DM_Reports_Setup.bat) is located in: ES1_CDRom\Setup\Reporting\Discovery Manager To install EMC Discovery Manager reports, on the SQL Server 2008, 2008 R2, or 2012 Report Server: 1. Log on with local administrator privileges on the computer. 2. Open a command window. 3. Run ES1_DM_Reports_Setup.bat. 4. At the following prompt, specify the SQL Server that hosts the EMC Discovery Manager database. Specify the IP address or the server name, or press Enter to accept the default (localhost). Specify SQL Server for Discovery Manager database <default:localhost>: 5. At the following prompt, specify the name of the EMC Discovery Manager database. Specify Discovery Manager Database Name: 72 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

73 Installing EMC SourceOne Reporting 6. At the following prompt, specify the URL of the Report Server Web Service. It is not necessary to include the port number. Specify Report Server Web Service URL: This URL must be the same one that you configured on the Web Service URL page in Reporting Services Configuration Manager. Figure 47 Example - Web Service URL Note: Do not specify the Report Manager URL. 7. At the View log file? <Y/N default:n> prompt, do one of the following steps: If you want to view the log file, press Y. If you do not want to view the log file, press N, or press Enter to accept the default (N). Installing EMC Discovery Manager reports 73

74 Installing EMC SourceOne Reporting Figure 48 Running ES1_DM_Reports_Setup.bat If the installation is successful, then you see messages confirming the installation of each report. If an error occurs during installation, then you see an error message. Verify report installation To verify that the reports were installed: 1. Start Internet Explorer. 2. Enter the Report Manager URL. (This is the URL shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.) Note: It may take a few minutes to access the URL, and it may appear that the access operation has hung. SQL Server Reporting Services flushes its cache if it is inactive for 20 minutes. 3. Verify that the SQL Server Reporting Services home page displays the EMC Discovery Manager folder. Figure 49 EMC Discovery Manager folder 74 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

75 Installing EMC SourceOne Reporting If you installed the EMC SourceOne reports previously, then you also see the EMC SourceOne folder. 4. Click the Discovery Manager folder to open it, and verify that it contains the Search Audit Reports subfolder. Figure 50 Discovery Manager reports subfolder Installing EMC Discovery Manager reports 75

76 Installing EMC SourceOne Reporting Controlling access to EMC SourceOne and Discovery Manager reports After you install EMC SourceOne reports and Discovery Manager reports, you must set permissions for users to access those reports. The examples in this section describe common scenarios, and assume: For EMC SourceOne reports: EMC SourceOne Management and EMC SourceOne reports are installed. SQL Server Reporting Services are installed on the same computer that hosts the EMC SourceOne Activity database. For Discovery Manager reports: EMC SourceOne Management, EMC SourceOne Discovery Manager, and Discovery Manager reports are installed. SQL Server Reporting Services are installed on the same computer that hosts the EMC SourceOne Discovery Manager database. Roles in Reporting Services In SQL Server Reporting Services, you can assign groups or users to different roles to control access to reports. For example, the Content Manager role could include administrator users who are able to view and customize reports, and the Browser role could include additional users who can only view reports. Most security access can be managed through the Reporting Server web portal without requiring SQL Server administration privileges. For example, if you give a user the Content Manager role for Discovery Manager reports, that user can manage the report security directly through the Reports portal. You can remove local administrator privileges from users who run or view the reports. However, those users can change report security and add themselves as report viewers. Microsoft does this by design to prevent lock-out situations. The Content Manager role and the Browser role have pre-defined permissions in Reporting Services. If these built-in roles are not appropriate, then you can create custom roles in SQL Server 76 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

77 Installing EMC SourceOne Reporting Management Studio. For example, if you want administrators to set up reports without being able to view them, then you could create a role that grants all permissions except for View Report. To customize roles further, refer to Microsoft documentation. Requirements for users and groups For Content Manager role Assigning the EMC SourceOne security group to the Content Manager role bypasses the need to set up additional permissions in Active Directory and SQL for report administration. Note: The EMC SourceOne security logins (SourceOne security group, SourceOne installation account, and SourceOne Admins group) have db_datareader and db_datawriter permissions on the SourceOne databases and the Discovery Manager database, as described in "Configure SQL permissions" in the EMC SourceOne Management Installation Guide and the EMC SourceOne Discovery Manager Installation and Administration Guide. For Browser role For users who will have read-only access to reports: 1. Create a group in Active Directory (for example EMC SourceOne Report Users), and add appropriate users to the group. 2. To view reports, members of this new group also need access to the appropriate database. Using SQL Server Management Studio: a. Add the group as a login. b. Under the appropriate EMC SourceOne database, assign the group the permissions described in the following table. Controlling access to EMC SourceOne and Discovery Manager reports 77

78 Installing EMC SourceOne Reporting Table 4 Database permissions for Browser role To view these reports Assign database role Assign explicit database permissions Assign schema/table-level permissions EMC SourceOne reports db_datareader on the SourceOne Activity database Connect and Execute on the SourceOne Activity database Not applicable EMC Discovery Manager reports Not applicable Note: For security reasons, do not grant db_datareader permission on the Discovery Manager database to read-only users of Discovery Manager reports. Connect and Execute on the Discovery Manager database SELECT permission on the AuditSchema schema in the Discovery Manager database Assigning users to roles You can specify security settings for all EMC SourceOne reports, for all Discovery Manager reports, for all reports in a folder, or for individual reports. To do so, you must be logged in as administrator, or you must be a user who already has the Content Manager role. To navigate to security settings and assign users to roles: 1. Using Internet Explorer, navigate to the SQL Server Reporting Services Home page. (Use the URL shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.) 2. Navigate to the Security tab of the folder or report for which you want to set access. For example, to specify security settings for all EMC SourceOne reports, do one of the following steps: In SQL Server 2008, open the EMC SourceOne folder, click the Properties tab, then click Security. In SQL Server 2008 R2, select Manage from the EMC SourceOne folder s dropdown menu, then click Security. 3. On the Security tab, click New Role Assignment. 4. Do one of the following steps: 78 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

79 Installing EMC SourceOne Reporting To specify users who can view and manage reports: a. In the Group or user name field, specify your EMC SourceOne security group. b. Select the Content Manager role. To specify users who have read-only access to reports: 5. Click OK. a. In the Group or user name field, specify the name of the report users group that you created in Active Directory. b. Select the Browser role. Controlling access to EMC SourceOne and Discovery Manager reports 79

80 Installing EMC SourceOne Reporting Authenticating with the EMC SourceOne Activity database If your Reporting Services are on a different computer than the one that hosts EMC SourceOne Activity database, when you view reports, you may experience errors relating to authentication with the Activity data source. This is the result of Windows Integrated Security, which can only pass credentials across one computer unless Kerberos is enabled. If this problem occurs, then do one of the following steps: Configure your network to use Kerberos. Configure the Activity data source to use Credentials supplied by the user running the report instead of Windows Authentication. When running reports, users will be prompted for valid credentials to connect to the SQL database. To change connection credentials for the Activity data source: 1. On the Home page of SQL Server Reporting Services, open the EMC SourceOne folder. 2. Click Show Details (SQL Server 2008) or Detail View (SQL Server 2008 R2). Figure 51 EMC SourceOne folder - Details view 3. Open the Data Sources folder. 4. Click the dses1activity link. 80 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

81 Installing EMC SourceOne Reporting Figure 52 Data Sources folder 5. On the Properties page: a. Select Credentials supplied by the user running the report. b. Select the Use as Windows credentials when connecting to the data source checkbox. Figure 53 Properties page - dses1activity data source 6. Click Apply. Authenticating with the EMC SourceOne Activity database 81

82 Installing EMC SourceOne Reporting Authenticating with the EMC Discovery Manager database If your Reporting Services are on a different computer than the one that hosts EMC Discovery Manager database, when you view Discovery Manager reports, you may experience errors relating to authentication with the Discovery Manager data source. This is the result of Windows Integrated Security, which can only pass credentials across one computer unless Kerberos is enabled. If this problem occurs, then do one of the following steps: Configure your network to use Kerberos. Configure the Discovery Manager data source to use Credentials supplied by the user running the report instead of Windows Authentication. When running reports, users will be prompted for valid credentials to connect to the SQL database. To change connection credentials for the Discovery Manager data source: 1. On the Home page of SQL Server Reporting Services, open the Discovery Manager folder. 2. Click Show Details (SQL Server 2008) or Detail View (SQL Server 2008 R2). 3. Open the Data Sources folder. 4. Click the dses1dm link. 5. On the Properties page: a. Select Credentials supplied by the user running the report. b. Select the Use as Windows credentials when connecting to the data source checkbox. 6. Click Apply. 82 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

83 Installing EMC SourceOne Reporting Configuring Internet Explorer for all EMC reports After installing EMC SourceOne reports and Discovery Manager reports, add the URL of the SQL Server Reporting Services web site to the Local Intranet Zone in Internet Explorer. (This URL is shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.) To configure Internet Explorer settings for client computers accessing the EMC SourceOne Reports or Discovery Manager Reports URL: 1. Open Internet Explorer. 2. Select Tools > Internet Options and select the Security tab. 3. Click Local intranet and select Custom Level. 4. Scroll to the bottom of the Settings pane. 5. In the User Authentication > Logon section, ensure that Automatic logon only in Intranet zone is selected. 6. Click OK to return to the Security tab. 7. Click Sites. 8. Click Advanced. 9. Add the URL of the SQL Server Reporting Services web site. When this configuration is complete, the Internet Security Properties icon displayed in the lower right side of the browser should indicate that the site is in the local intranet. Configuring Internet Explorer for all EMC reports 83

84 Installing EMC SourceOne Reporting Maintaining the installation This section provides information on maintaining installation of the components described in this chapter. Upgrade Refer to the product release notes for detailed instructions on upgrading EMC SourceOne reports and Discovery Manager reports. Uninstall reports To uninstall EMC SourceOne reports and Discovery Manager reports, including all customizations: 1. You must have System Administrator privileges for SQL Server Reporting Services. 2. In Internet Explorer, enter the Report Manager URL for your SQL Server Reporting Services. The SQL Server Reporting Services home page opens. 3. Click Show Details on the right side of the toolbar. The home page lists the Data Sources, the EMC SourceOne folders, and the EMC Discovery Manager folder. 4. Select the checkboxes for both the Data Sources, the EMC SourceOne folders, and the Discovery Manager folder. 5. Click Delete on the toolbar. 84 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

85 6 Running EMC SourceOne Reports This chapter describes how to access and view EMC SourceOne reports. Note: To export and print reports, refer to Working with reports on page 26. This chapter includes the following topics: Accessing EMC SourceOne reports Mapped Folder Permissions Audit report Mapped Folder Effective Permissions report Specifying parameters for Search Audit reports (Search) Search Activity report (Search) Search Copy report (Search) Search Delete report (Search) Search Restore report (Search) Documents Copied report (Search) Documents Deleted report (Search) Documents Restored report (Search) Documents Viewed report (Search) Data Source Processing report Management Activity dashboard Search Activity dashboard SharePoint Management Activity Dashboard Files Management Activity Dashboard Running EMC SourceOne Reports 85

86 Running EMC SourceOne Reports Accessing EMC SourceOne reports To access EMC SourceOne reports: 1. In Internet Explorer 7.0 or higher, enter the URL for your SQL Server 2008, 2008 R2, or 2012 Reporting Services, as provided by your system administrator. The SQL Server Reporting Services home page opens. It displays the EMC SourceOne folder. Figure 54 EMC SourceOne folder on SQL Server 2008 Reporting Services home page If EMC Discovery Manager reports are installed, then the EMC Discovery Manager folder is also displayed. 2. Click the EMC SourceOne folder to open it. The EMC SourceOne page displays the following subfolders: Configuration Reports Search Audit Reports System Reports Figure 55 EMC SourceOne reports page 3. To access a report, open the appropriate subfolder. The Configuration Reports folder contains the reports described in the following table. 86 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

87 Running EMC SourceOne Reports Figure 56 Configuration Reports folder Table 5 Reports in Configuration Reports folder Report Mapped Folder Effective Permissions report on page 95 Mapped Folder Permissions Audit report on page 91 Description Shows the EMC SourceOne mapped folder permissions that were in effect for a specific user on a specific date. Shows when mapped folder permissions changed for specific users during a specific period or date range, and who changed the permissions. The Search Audit Reports folder contains the reports described in the following table. Figure 57 Search Audit Reports folder on SQL Server 2008 R2 Reporting Services Accessing EMC SourceOne reports 87

88 Running EMC SourceOne Reports Table 6 Reports in Search Audit Reports folder Report Documents Copied report (Search) on page 112 Documents Deleted report (Search) on page 116 Documents Restored report (Search) on page 119 Documents Viewed report (Search) on page 123 Search Activity report (Search) on page 100 Search Copy report (Search) on page 103 Search Delete report (Search) on page 106 Search Restore report (Search) on page 109 Description Lists the documents that were copied to mapped folders in EMC SourceOne Search using the Copy To operation. Lists the documents that were deleted in EMC SourceOne Search using the Delete operation. Lists the documents that were restored in EMC SourceOne Search using the Restore operation. Lists the documents that were viewed or previewed in EMC SourceOne Search. Lists the searches that were performed in EMC SourceOne Search. Lists the Copy To operations that were performed in EMC SourceOne Search. Lists the Delete operations that were performed in EMC SourceOne Search. Lists the Restore operations that were performed in EMC SourceOne Search. The System Reports folder contains the reports described in the following table. Figure 58 System Reports folder 88 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

89 Running EMC SourceOne Reports Table 7 Reports in System Reports folder Report Data Source Processing report on page 127 Management Activity dashboard on page 140 Description Displays statistics about the processing of: mailboxes and PSTs for specific SourceOne management activities for the specified period items for SourceOne SharePoint Archive and SharePoint Online Archive activities for the specified period (available if EMC SourceOne for Microsoft SharePoint is installed on your SourceOne system) files for Files activities for the specified periods (available if EMC SourceOne for File Systems is installed on your SourceOne system) Displays statistics for a specific type of management activity and specific period. Note: This dashboard shows processing metrics from the front-end SourceOne Activity database for the most commonly-used management activities, not archiving metrics from the back-end archive server. Search Activity dashboard on page 155 SharePoint Management Activity Dashboard on page 161 Displays statistics about the following EMC SourceOne Search and Discovery Manager jobs for the specified period of time: EMC SourceOne Search - search, copy, and restore jobs Discovery Manager - search, copy, and export jobs Available if EMC SourceOne for Microsoft SharePoint is installed on your SourceOne system. Displays statistics for the following SourceOne SharePoint activities: SharePoint Archive SharePoint Online Archive Note: This dashboard shows processing metrics from the front-end SourceOne Activity database, not archiving metrics from the back-end archive server. Accessing EMC SourceOne reports 89

90 Running EMC SourceOne Reports Table 7 Reports in System Reports folder (continued) Report Files Management Activity Dashboard on page 173 Description Available if EMC SourceOne for File Systems is installed on your SourceOne system. Displays statistics for the following SourceOne Files activities: File Archive - Historical File Delete - Historical File Removal Note: This dashboard shows processing metrics from the front-end SourceOne Activity database, not archiving metrics from the back-end archive server. 90 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

91 Running EMC SourceOne Reports Mapped Folder Permissions Audit report The Mapped Folder Permissions Audit report shows when mapped folder permissions changed for specific users during a specific period or date range, and who changed the permissions. Prerequisite: Mapped Folder Permissions Audit report To configure permissions on mapped folders, refer to the EMC SourceOne Management Administration Guide, "Configuring Mapped Folders." Procedure: Mapped Folder Permissions Audit report To run the Mapped Folder Permissions Audit report: 1. Access the Mapped Folder Permissions Audit report (Home > EMC SourceOne > Configuration Reports > Mapped Folder Permissions Audit Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Mapped Folder Permissions Audit report on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Mapped Folder Permissions Audit report on page 93. Specifying parameters for Mapped Folder Permissions Audit report Enter report parameters, as described in the following table. To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. Mapped Folder Permissions Audit report 91

92 Running EMC SourceOne Reports Figure 59 Parameters for Mapped Folder Permissions Audit report Table 8 Parameters for Mapped Folder Permissions Audit report Parameter Begin Date End Date Period Modified By Mapped Folder Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. To specify a period of time, select an option in the Period field: All Dates Today Yesterday Last 24 Hours This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. Select a user who modified the permissions. Select a mapped folder. The list shows active mapped folders, not mapped folders that have been deleted. 92 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

93 Running EMC SourceOne Reports Table 8 Parameters for Mapped Folder Permissions Audit report (continued) Parameter Folder User Description Select the user whose permissions you want to view. Names are listed in display name format or LDAP format, depending on how they were specified in the Mapped Folder configuration wizard. Understanding the Mapped Folder Permissions Audit report This section describes the information displayed in the Mapped Folder Permissions Audit report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 60 Example - Mapped Folder Permissions Audit report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report Table 9 Body of Mapped Folder Permissions Audit report Column Date Mapped Folder Modified By Description The date on which the search was performed. By default, dates are sorted in descending order (newest dates first). A blue value indicates that you can click on it to drill through to the associated Mapped Folder Effective Permissions report. Refer to Understanding the Mapped Folder Effective Permissions report on page 96. The name of the EMC SourceOne mapped folder. The name of the user who changed the folder permissions. Mapped Folder Permissions Audit report 93

94 Running EMC SourceOne Reports Table 9 Body of Mapped Folder Permissions Audit report Column Action Folder User Permission Description The type of change: Added = Folder permissions were added to a user. Removed = Folder permissions were removed from a user. The name of the user whose folder permissions were changed. The name of the folder permission added to or removed from the user. 94 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

95 Running EMC SourceOne Reports Mapped Folder Effective Permissions report The Mapped Folder Effective Permissions report shows the EMC SourceOne mapped folder permissions that were in effect for a specific user on a specific date. Prerequisite: Mapped Folder Effective Permissions report To configure permissions on mapped folders, refer to the EMC SourceOne Management Administration Guide, "Configuring Mapped Folders." Procedure: Mapped Folder Effective Permissions report To run the Mapped Folder Effective Permissions report: 1. Access the Mapped Folder Effective Permissions report (Home > EMC SourceOne > Configuration Reports > Mapped Folder Effective Permissions Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Mapped Folder Effective Permissions report on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Mapped Folder Effective Permissions report on page 96. Specifying parameters for Mapped Folder Effective Permissions report Enter report parameters, as described in the following table. Figure 61 Parameters for Mapped Folder Effective Permissions report Mapped Folder Effective Permissions report 95

96 Running EMC SourceOne Reports Table 10 Parameters for Mapped Folder Effective Permissions report Parameter Date Folder User Mapped Folder Description Click the calendar icon, then select the date for which you want to view permissions. Select the user whose permissions you want to view. Names are listed in display name format or LDAP format, depending on how they were specified in the Mapped Folder configuration wizard. Select a mapped folder. The list shows active mapped folders, not mapped folders that have been deleted. Understanding the Mapped Folder Effective Permissions report This section describes the information displayed in the Mapped Folder Effective Permissions report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 62 Example - Mapped Folder Effective Permissions report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

97 Running EMC SourceOne Reports Body of report Table 11 Body of Mapped Folder Effective Permissions report Column Mapped Folder Folder User Effective Permissions on <date> Last Changed Description The name of the EMC SourceOne mapped folder. The name of the user. A blue value indicates that you can click on it to drill through to the associated Mapped Folder Permissions Audit report. Refer to Understanding the Mapped Folder Permissions Audit report on page 93. A green checkmark indicates the user had that folder permission on the specified date. The date and time on which the permissions were last changed before the effective permission date for the user on that folder. Mapped Folder Effective Permissions report 97

98 Running EMC SourceOne Reports Specifying parameters for Search Audit reports (Search) To specify parameters for any Search Audit report in the EMC SourceOne > Search Audit Reports folder: 1. Access the report, as described in Accessing EMC SourceOne reports on page 86. Figure 63 Example - default parameters for Search Activity (Search) report 2. Enter report parameters, as described in the following table. To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. Table 12 Search Activity (Search) report parameters Parameter Begin Date End Date Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. 98 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

99 Running EMC SourceOne Reports Table 12 Search Activity (Search) report parameters (continued) Parameter Period User Expand All Groups Description To specify a period of time, select an option in the Period field: All Dates Today Yesterday Last 24 Hours This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. To specify the search user, select an option in the User field: All (default) The name of a search user The User field lists the names of users performed an audited search operation. If a user has not been audited, then his name does not appear in the list. Select one of the Expand All Groups options: True - Expands all rows and sections to display details. False (default) - Does not expand all rows and sections. Specifying parameters for Search Audit reports (Search) 99

100 Running EMC SourceOne Reports Search Activity report (Search) The Search Activity report lists the audited searches that were performed in EMC SourceOne Search. Prerequisite: Search Activity report (Search) Before you can run a Search Activity report for audited users, you must enable the Audit search activities configuration setting and specify the audited users. To configure auditing, refer to in the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Searches performed using the Administrator search type are always audited. Procedure: Search Activity report (Search) To run the Search Activity report: 1. Access the Search Activity report (Home > EMC SourceOne > Search Audit Reports > Search Activity Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Search Activity report (Search) on page 100. Understanding the Search Activity report (Search) This section describes the information displayed in the Search Activity report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. 100 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

101 Running EMC SourceOne Reports Figure 64 Example - Search Activity report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report The first row shows totals for some columns. Table 13 Body of Search Activity report Column Date User Description The date on which the search was performed. The display name of the search user who performed the search. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Folders Search Terms Results Viewed The names of the EMC SourceOne mapped folders that were searched. The search criteria. If the search user did not specify criteria, then the Search Terms column displays Date <= The number of results returned by the search. The number of items in search results that were viewed by the user. A blue number indicates that you can click on it to drill through to the associated Documents Viewed report. Refer to Understanding the Documents Viewed report on page 124. Search Activity report (Search) 101

102 Running EMC SourceOne Reports Search Operation Details To see details for a search operation, expand the row by clicking the plus sign (+) next to the date. Table 14 Search Operation Details in Search Activity report Column Date User Description The date on which the search was performed. The name of the search user who performed the search. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Results Viewed Items Folders Searched Search Terms JobID The number of results returned by the search. The number of items in search results that were viewed by the user. A blue number indicates that you can click on it to drill through to the associated Documents Viewed report. Refer to Understanding the Documents Viewed report on page 124. The names of the EMC SourceOne mapped folders that were searched. The search criteria. The ID of the job associated with the search operation. 102 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

103 Running EMC SourceOne Reports Search Copy report (Search) The Search Activity report lists the audited Copy To operations that were performed in EMC SourceOne Search. Prerequisite: Search Copy report The Copy To operation in Search is available only for the Administrator search type. Copy To activities are always audited for the Administrator search type. To be able to drill through to a Documents Copied report from a Search Copy report, you must enable the Capture document details setting associated with the Audit copy to folders activities setting for Administrators. To configure auditing, refer to the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Search Copy report To run the Search Copy report: 1. Access the Search Copy report (Home > EMC SourceOne > Search Audit Reports > Search Copy Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Search Copy report on page 104. Search Copy report (Search) 103

104 Running EMC SourceOne Reports Understanding the Search Copy report This section describes the information displayed in the Search Copy report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 65 Example - Search Copy report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report The first row shows totals for some columns. Table 15 Body of Search Copy report Column Date User Description The date on which the Copy To operation was performed. The display name of the user who performed the Copy To operation. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Destination Folder Copied Failed The name of the EMC SourceOne mapped folder to which documents were copied. The number of documents that were copied successfully. The number of documents that failed to copy. Refer to Copy To operations and Restore operations on page 23 for more information. 104 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

105 Running EMC SourceOne Reports Table 15 Body of Search Copy report (continued) Column Audited Description The total number of documents that were audited in the Copy To operation, including documents that copied successfully and documents that failed to copy. A blue number indicates that you can click on it to drill through to the associated Documents Copied report, if the Capture document details auditing option was enabled. Refer to Understanding the Documents Copied report on page 113. Copy Operation Details To see details for a copy operation, expand the row by clicking the plus sign (+) next to the date. Table 16 Copy Operation Details in Search Copy report Column Date User Description The date on which the Copy To operation was performed. The name of the user who performed the Copy To operation. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Copied Items Failed Items Audited Items Destination Folder Job ID The number of documents that were copied successfully. The number of documents that failed to copy. Refer to Copy To operations and Restore operations on page 23 for more information. The total number of documents that were audited in the Copy To operation, including documents that copied successfully and documents that failed to copy. A blue number indicates that you can click on it to drill through to the associated Documents Copied report, if the Capture document details auditing option was enabled. Refer to Understanding the Documents Copied report on page 113. The name of the EMC SourceOne mapped folder to which documents were copied. The ID of the job associated with the Copy To operation. Search Copy report (Search) 105

106 Running EMC SourceOne Reports Search Delete report (Search) The Search Delete report lists the audited Delete operations that were performed in EMC SourceOne Search. Prerequisite: Search Delete report Delete operations are always audited for the Administrator search type. Before you can run a Search Delete report for audited users, you must enable the Audit delete activities setting and specify the audited users. To be able to drill through to a Documents Deleted report from a Search Delete report, you must enable the Capture document details setting associated with the Audit delete activities setting. To configure auditing, refer to the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Search Delete report To run the Search Delete report: 1. Access the Search Activity report (Home > EMC SourceOne > Search Audit Reports > Search Delete Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Search Delete report on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

107 Running EMC SourceOne Reports Understanding the Search Delete report This section describes the information displayed in the Search Delete report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 66 Example - Search Delete report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report The first row shows totals for some columns. Table 17 Body of Search Delete report Column Date User Description The date on which the Delete operation was performed. The display name of the user who performed the Delete operation. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Search Delete report (Search) 107

108 Running EMC SourceOne Reports Table 17 Body of Search Delete report Column Deleted Failed Audited Description The number of documents that were deleted successfully. The number of documents that failed to be deleted. The total number of documents that were audited in the Delete operation, including documents that deleted successfully and documents that failed to delete. A blue number indicates that you can click on it to drill through to the associated Documents Deleted report, if the Capture document details auditing option was enabled. Refer to Understanding the Documents Deleted report on page 117. Delete Operation Details To see details for a delete operation, expand the row by clicking the plus sign (+) next to the date. Table 18 Delete Operation Details in Search Delete report Column Date User Description The date on which the Delete operation was performed. The name of the user who performed the Delete operation. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Deleted Items Failed Items Audited Items Job ID The number of documents that were deleted successfully. The number of documents that failed to be deleted. The total number of documents that were audited in the Delete operation, including documents that deleted successfully and documents that failed to delete. A blue number indicates that you can click on it to drill through to the associated Documents Deleted report, if the Capture document details auditing option was enabled. Refer to Understanding the Documents Deleted report on page 117. The ID of the job associated with the Delete operation. 108 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

109 Running EMC SourceOne Reports Search Restore report (Search) The Search Restore report lists the audited Restore operations that were performed in EMC SourceOne Search. Prerequisite: Search Restore report Restore operations are always audited for Administrators. Before you can run a Search Restore report for audited users, you must enable the Audit restore activities setting and specify the audited users. To be able to drill through to a Documents Restored report from a Search Restore report, you must enable the Capture document details setting associated with the Audit delete activities setting. To configure auditing, refer to the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Search Restore report To run the Search Restore report: 1. Access the Search Restore report (Home > EMC SourceOne > Search Audit Reports > Search Restore Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Search Restore report on page 110. Search Restore report (Search) 109

110 Running EMC SourceOne Reports Understanding the Search Restore report This section describes the information displayed in the Search Restore report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 67 Example - Search Restore report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report The first row shows totals for some columns. Table 19 Body of Search Restore report Column Date User Description The date on which the Restore operation was performed. The display name of the user who performed the Restore operation. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Destination Mailbox The mailbox to which the documents were restored. 110 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

111 Running EMC SourceOne Reports Table 19 Body of Search Restore report (continued) Column Restored Failed Audited Description The number of documents that were restored successfully. The number of documents that failed to be restored. Refer to Copy To operations and Restore operations on page 23 for more information. The total number of documents that were audited in the Restore operation, including documents that restored successfully and documents that failed to restore. A blue number indicates that you can click on it to drill through to the associated Documents Restored report, if the Capture document details auditing option was enabled. Refer to Understanding the Documents Restored report on page 120. Restore Operation Details To see details for a restore operation, expand the row by clicking the plus sign (+) next to the date. Table 20 Restore Operation Details in Search Restore report Column Date User Description The date on which the Restore operation was performed. The name of the user who performed the Restore operation. Search Role The role of the search user, as described in Search roles for SourceOne Search reports on page 19. Restored Items Failed Items Audited Items Destination Mailbox Job ID The number of documents that were restored successfully. The number of documents that failed to be restored. Refer to Copy To operations and Restore operations on page 23 for more information. The total number of documents that were audited in the Restore operation, including documents that restored successfully and documents that failed to restore. A blue number indicates that you can click on it to drill through to the associated Documents Restored report, if the Capture document details auditing option was enabled. Refer to Understanding the Documents Restored report on page 120. The mailbox to which the documents were restored. The ID of the job associated with the Restore operation. The Job ID also is displayed in the Job Management area of the EMC SourceOne console. Search Restore report (Search) 111

112 Running EMC SourceOne Reports Documents Copied report (Search) The Documents Copied report lists the items that were copied to mapped folders in EMC SourceOne Search using the Copy To operation. Prerequisite: Documents Copied report The Copy To operation in EMC SourceOne Search is available only for the Administrator search type. Copy To activities are always audited for Administrators. Before you can run a Documents Copied report for Administrators, you must enable the Capture document details setting associated with the Audit copy to folders activities setting. To configure auditing, refer to the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Documents Copied report To run the Documents Copied report: 1. Access the Documents Copied report (Home > EMC SourceOne > Search Audit Reports > Documents Copied Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Documents Copied report on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

113 Running EMC SourceOne Reports Understanding the Documents Copied report This section describes the information shown in the Documents Copied report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 68 Example - Documents Copied report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report Table 21 Body of Documents Copied report Column Date Copied User Document ID Description The date on which the document was copied in EMC SourceOne Search. The display name of the user who performed the Copy To operation. The ID of the copied document. Documents Copied report (Search) 113

114 Running EMC SourceOne Reports Table 21 Body of Documents Copied report (continued) Column Document Date Title Job ID Description The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. The ID of the copy job that processed the document, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Copy report. Refer to Understanding the Search Copy report on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

115 Running EMC SourceOne Reports Details To see details, expand the row by clicking the plus sign (+) next to the date. Table 22 Details in Documents Copied report Section Column Description Copy Operation Details Date Copied User Destination Folder Copy Job ID The date on which the document was copied in EMC SourceOne Search. The Administrator search user who performed the Copy To operation. The name of the EMC SourceOne mapped folder to which the document was copied. The ID of the copy job that processed the document, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Copy report. Document Details Document ID The ID of the copied document. Document Date Title Document Type Size Attachments Encrypted Sender The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. The type of document (for example, Message, Contact, or Meeting). The size of the document. Applies to document types. The number of attachments associated with the document. Applies to document types. False = The document is not encrypted. True = The document is encrypted. For other content types, this is NA (not applicable) or empty. Applies to and SharePoint document types. The sender of the document. An example is: E5 Admin</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin> Documents Copied report (Search) 115

116 Running EMC SourceOne Reports Documents Deleted report (Search) The Documents Deleted report lists the items that were deleted in EMC SourceOne Search using the Delete operations. Prerequisite: Documents Deleted report Before you can run a Documents Deleted report: For the Administrator search type, you must enable the Capture document details setting associated with the Audit delete activities setting. Delete activities are always audited for the Administrator search type. For audited users, you must enable the Audit delete activities setting and the associated Capture document details setting. You must also specify the audited users. To configure auditing, rrefer to in the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Documents Deleted report To run the Documents Deleted report: 1. Access the Documents Deleted report (Home > EMC SourceOne > Search Audit Reports > Documents Deleted Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Documents Deleted report on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

117 Running EMC SourceOne Reports Understanding the Documents Deleted report This section describes the information shown in the Documents Deleted report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 69 Example - Documents Deleted report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report Table 23 Body of Documents Deleted report Column Date Deleted User Document ID Document Date Title Description The date on which the document was deleted in EMC SourceOne Search. The display name of the user who performed the Delete operation. The ID of the document. The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. Documents Deleted report (Search) 117

118 Running EMC SourceOne Reports Table 23 Body of Documents Deleted report (continued) Column Job ID Description The ID of the delete job that processed the document, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Delete report. Refer to Understanding the Search Delete report on page 107. Details To see details, expand the row by clicking the plus sign (+) next to the date. Table 24 Details in Documents Deleted report Section Column Description Delete Operation Details Date Deleted User Folder Delete Job ID The date on which the document was viewed in EMC SourceOne Search. The user who performed the Delete operation in Search. The name of the EMC SourceOne mapped folder from which the document was deleted. The ID of the job associated with the search, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Delete report. Document Details Document ID The ID of the viewed document. Document Date Title Document Type Size Sender The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. The type of document (for example, Message, Contact, or Meeting). The size of the document. Applies to and SharePoint document types. The sender of the document. An example is: E5 Admin</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin> 118 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

119 Running EMC SourceOne Reports Documents Restored report (Search) The Documents Restored report lists the items that were restored in EMC SourceOne Search using the Restore operation. Prerequisite: Documents Restored report Before you can run a Documents Restored report: For the Administrator search type, you must enable the Capture document details setting associated with the Audit restore activities setting. Restore activities are always audited for the Administrator search type. For audited users, you must enable the Audit restore activities setting and the associated Capture document details setting. You must also specify the audited users. To configure auditing, refer to in the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Documents Restored report To run the Documents Restored report: 1. Access the Documents Restored report (Home > EMC SourceOne > Search Audit Reports > Documents Restored Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Documents Restored report on page 120. Documents Restored report (Search) 119

120 Running EMC SourceOne Reports Understanding the Documents Restored report This section describes the information shown in the Documents Restored report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 70 Example - Documents Restored report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report Table 25 Body of Documents Restored report Column Date Restored User Document ID Document Date Description The date on which the document was restored in EMC SourceOne Search. The display name of the user who restored the document. The ID of the document. The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time 120 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

121 Running EMC SourceOne Reports Table 25 Body of Documents Restored report (continued) Column Title Job ID Description The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. The ID of the restore job that processed the document, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Activity report. Refer to Understanding the Search Activity report (Search) on page 100. Documents Restored report (Search) 121

122 Running EMC SourceOne Reports Details To see details, expand the row by clicking the plus sign (+) next to the date. Table 26 Details in Documents Restored report Section Column Description Restore Operation Details Date Restored User Destination Mailbox Restore Job ID The date on which the document was restored in EMC SourceOne Search. The user who performed the Restore operation in Search. The mailbox to which the document was restored. The ID of the restore job that processed the document, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Restore report. Document Details Document ID The ID of the viewed document. Document Date Title Document Type Size Attachments Encrypted Sender The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. The type of document (for example, Message, Contact, or Meeting). The size of the document. Applies to document types. The number of attachments associated with the document. Applies to document types. False = The document is not encrypted. True = The document is encrypted. For other content types, this is NA (not applicable) or empty. Applies to and SharePoint document types. The sender of the document. An example is: E5 Admin</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin> 122 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

123 Running EMC SourceOne Reports Documents Viewed report (Search) The Documents Viewed report lists the items that were viewed or previewed in EMC SourceOne Search. Prerequisite: Documents Viewed report Viewed documents are always audited for Administrators. Before you can run a Documents Viewed report for audited users, you must enable the Audit search result view activities setting and specify audited users. To configure auditing, refer to in the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Documents Viewed report To run the Documents Viewed report: 1. Access the Documents report (Home > EMC SourceOne > Search Audit Reports > Documents Viewed), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for Search Audit reports (Search) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Documents Viewed report on page 124. Documents Viewed report (Search) 123

124 Running EMC SourceOne Reports Understanding the Documents Viewed report This section describes the information shown in the Documents Viewed report. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 71 Example - Documents Viewed report For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report Table 27 Body of Documents Viewed report Column Date Viewed User Document ID Description The date on which the document was viewed in EMC SourceOne Search. The name of the user who viewed the document. The ID of the document. 124 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

125 Running EMC SourceOne Reports Table 27 Body of Documents Viewed report (continued) Column Document Date Title Job ID Description The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. The ID of the search job that processed the document, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Activity report. Refer to Understanding the Search Activity report (Search) on page 100. Details To see details, expand the row by clicking the plus sign (+) next to the date. Table 28 Details in Documents Viewed report Section Column Description Activity Details Date Viewed The date on which the document was viewed in EMC SourceOne Search. User Folder Search Job ID The user who performed the search. The name of the EMC SourceOne mapped folder where the document was found. The ID of the job associated with the search, and from which the audit was captured. A blue number indicates that you can click on it to drill through to the associated Search Activity report. Documents Viewed report (Search) 125

126 Running EMC SourceOne Reports Table 28 Details in Documents Viewed report (continued) Section Column Description Document Details Document ID The ID of the viewed document. Document Date Title Document Type Size Attachments Encrypted Sender Recipients (partial) The meaning of this date depends on the document type: Message date stored in the EMC SourceOne database SharePoint content: Creation date Files: Last modified time The title of the document. For , this is the subject. For SharePoint content, this is the title. For files, this is the file name. The type of document (for example, Message, Contact, or Meeting). The size of the document. Applies to document types. The number of attachments associated with the document. Applies to document types. False = The document is not encrypted. True = The document is encrypted. For other content types, this is NA (not applicable) or empty. Applies to and SharePoint document types. The sender of the document. For , this is the EX formatted address, for example: EX:\"E5 Admin\"</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin> A partial list of the recipients of the document. An example of an recipient is: E5 Admin</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin> This field is empty for Delete document-level auditing, and is not applicable to every document type. This field will also be empty for CopyTo and Restore operations unless the document information was captured earlier from a view or preview. 126 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

127 Running EMC SourceOne Reports Data Source Processing report The Data Source Processing report shows statistics about the data sources processed by a selected EMC SourceOne activity for a specified period of time. The File activities are available if you have EMC SourceOne for File Systems installed. The SharePoint activities are available if you have EMC SourceOne for Microsoft SharePoint installed. The activities are: Archive - Historical Archive - PST/NSF Archive - User Directed Archive Delete - Historical Delete - User Directed Archive Delete - User Initiated Delete File Archive - Historical File Delete - Historical File Removal Journal (default) Migrate - PST Restore Shortcuts - Historical & UDA SharePoint Archive SharePoint Online Archive Shortcut - Historical Shortcut - User Directed Archive Update Shortcuts - Historical & UDA For SourceOne Management activities, the data sources include mailboxes and PSTs. For SourceOne SharePoint Archive and SharePoint Online Archive activities, the data sources are SharePoint lists. For File activities, the data sources are file shares. Data Source Processing report 127

128 Running EMC SourceOne Reports Prerequisites: Data Source Processing report The SharePoint Archive activity and the SharePoint Online Archive activity are available in the Data Source Processing report if EMC SourceOne for Microsoft SharePoint 7.0 or later is installed on your SourceOne 7.0 or later system. The File Archive - Historical, File Delete - Historical, and File Removal activities are available in the Data Source Processing report if EMC SourceOne for File Systems 6.8 or later is installed on your SourceOne 7.0 or later system. The Data Source Processing report is not an audit report, so no auditing configuration is required. The report shows information that is always captured in the EMC SourceOne Activity database, including management data that was captured before you installed EMC SourceOne 7.0. SharePoint and File data are captured starting with EMC SourceOne 7.0. Considerations and limitations: Data Source Processing report The Data Source Processing report shows , SharePoint, and files processing metrics from the front-end SourceOne Activity database, not , SharePoint, and files archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct. Procedure: Data Source Processing report To run the Data Source Processing report: 1. Access the Data Source Processing report (Home > EMC SourceOne > System Reports > Data Processing Report), as described in Accessing EMC SourceOne reports on page Enter report parameters, as described in Specifying parameters for the Data Source Processing report on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Data Source Processing report on page 131 and Drill through to Process Details section on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

129 Running EMC SourceOne Reports Specifying parameters for the Data Source Processing report Enter report parameters, as described in the following table. To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. Figure 72 Data Source Processing report parameters Table 29 Data Source Processing report parameters Parameter Begin Date End Date Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Data Source Processing report 129

130 Running EMC SourceOne Reports Table 29 Data Source Processing report parameters (continued) Parameter Period Activity Detailed Description To specify a period of time, select an option in the Period field: Today Yesterday This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year All Dates Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. Select an EMC SourceOne activity. The default is Journal. Select one of the following options: True - Generates a Process Details section for the specified activity, and enables drill through to the Process Details section False - Does not generate a Process Details section (default). 130 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

131 Running EMC SourceOne Reports Understanding the Data Source Processing report The Data Source Processing report displays processing statistics for the period and activity that you specified. Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. Figure 73 Example - Data Source Processing report for Journal activity Data Source Processing report 131

132 Running EMC SourceOne Reports Figure 74 Example - Data Source Processing report for SharePoint Online Archive activity 132 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

133 Running EMC SourceOne Reports Figure 75 Example - Data Source Processing report for Files Archive - Historical activity Note: In Internet Explorer 8 and above, text does not wrap in columns if there are no blanks in the text (for example, the SharePoint URLs shown in Figure 74). In printed and exported reports, the text wraps correctly and page width is honored. Documents/Items/ Files section For Management activities, this section is labeled Documents. For SharePoint activities, this section is labeled Items. For File activities, this section is labeled Files. Data Source Processing report 133

134 Running EMC SourceOne Reports This section shows the number of processed, duplicate, failed, and discarded items for a specific activity. Table 30 describes the information displayed in the area below the bar graph. If the Detailed parameter was set to True, then you can click on a blue number to drill through to the Process Details section. Refer to Drill through to Process Details section on page 136. Table 30 Documents/Items/Files section of Data Source Processing report Column Processed Duplicate Failed Discarded Description The total number of items found and processed from the data source by the activity. For archive activities, this number is not necessarily the same as the number of items that are archived. The number of duplicate items in any folder at the time of processing. The number of items that failed to process successfully in any folder. The number of items that were discarded from all folders because they did not match any archiving rules. Note: This field is used only for Management archive activities. This value is 0 for all other Management activities and for SharePoint archive activities and File archive activities. With Attachments The number of items that had attachments. Mailboxes/ Data Sources/ File Shares section For Management activities, this section is labeled Mailboxes. For SharePoint activities: This section is labeled Data Sources. A data source is a SharePoint list. For Files activities, this section is labeled File Shares. This section shows mailbox, data source, or file share statistics for a specific activity and period or date range. Table 31 describes the information displayed in the area below the bar graph. 134 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

135 Running EMC SourceOne Reports A blue number indicates that you can click on it to drill through to the Process Details section. Refer to Drill through to Process Details section on page 136. Table 31 Mailboxes/Data Sources/File Shares section of Data Source Processing report Column Total Processed Mailboxes/Data Sources/File Shares With Failed Documents/Items/Files Total Size Processed Avg. Mailbox/Data Source/File Share Size Avg. Processing Time per Mailbox/ Data Source/File Share Avg. Documents/Items/Files per Mailbox/ Data Source/File Share Description The total number of mailboxes, SharePoint data sources, or file shares processed by the activity for the specified period or date range. The number of mailboxes, SharePoint data sources, or file shares with documents, items, or files items that failed to process for the specified period or date range. The total size of the mailboxes, SharePoint data sources, or file shares processed for the specified period or date range. The average size of the mailboxes, SharePoint data sources, or file shares processed for the specified period or date range. The average amount of time to process each mailbox, SharePoint data source, or file share for the specified period or date range. The average number of items processed for each mailbox, SharePoint data source, or file share for the specified period or date range. Top 10 Mailboxes/ Data Sources/ FIle Shares section Table 32 For Management activities, this section is labeled Top 10 Mailboxes. For SharePoint activities, this section is labeled Top 10 Data Sources. For Files activities, this section is labeled Top 10 File Shares. This section shows statistics for the ten mailboxes, data sources, or file shares that had the most items processed for the selected activity and period. Table 32 describes the information displayed in the area next to the graph. Top 10 Mailboxes/Data Sources/FIle Shares section of Data Source Processing report Column Data Source/File Share Description The name of the mailbox, SharePoint data source, or file share. Data Source Processing report 135

136 Running EMC SourceOne Reports Table 32 Top 10 Mailboxes/Data Sources/FIle Shares section of Data Source Processing report (continued) Column Processed Duplicate Failed Description The total number of items processed for the mailbox, SharePoint data source, or file share by the activity. The number of duplicate items. The number of items that failed to process for the mailbox, SharePoint data source, or file share. Drill through to Process Details section If you enabled the Details: True parameter, then: A Process Details section is generated for the specified activity. Blue numbers in the Data Sources Processing report indicate that you can drill through to the Process Details section. Figure 76 Example - Data Source Processing report with Details set to True (Historical Archive activity) 136 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

137 Running EMC SourceOne Reports Figure 77 Example - Data Source Processing report with Details set to True (SharePoint Archive activity) Figure 78 Example - Data Source Processing report with Details set to True (File Archive - Historical activity) Click on a blue number to view the associated Process Details section. Data Source Processing report 137

138 Running EMC SourceOne Reports Figure 79 Example - Process Details section of Data Source Processing report (Historical Archive activity Figure 80 Example - Process Details section of Data Source Processing report (SharePoint Archive activity) Figure 81 Example - Process Details section of Data Source Processing report (File Archive - Historical activity) The Process Details section shows details about all the data sources that were processed by the specified activity in the specified period or date range. If the specified date range is within a calendar month, then the first column is labeled Day. 138 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

139 Running EMC SourceOne Reports If the specified date range spans two or more calendar months, then the first column is labeled Month. For example, if you select October 30, 2011 for the Begin Date and November 10, 2011 as the End Date, the first column is labeled Month even though the date range includes fewer than 30 days. The report displays data in months rather than days to save database and reporting resources. The Total row on each page displays the total for each column for the entire result set. Table 33 describes the statistics shown for each mailbox. Table 33 Process Details section Column Date/Period Mailbox/ Data Source/ File Share Processed Duplicate Failed Discarded Description The date or period in which the data source was processed. The name of the mailbox, SharePoint data source, or file share that was processed. The SharePoint data source name includes the name of the SharePoint list, the URL, and the GUID. The total number of items processed for the data source. The number of duplicate items. The number of failed items. The number of items that were discarded because they did not match any archiving rules. Note: This field is used only for Management archive activities. This value is 0 for all other Management activities and for SharePoint archive activities and File archive activities. Processed Size (MB) Duplicate Size (MB) Size Before (MB) Size After (MB) The total size of all items processed for the data source. The size of all duplicate items. The size of the data source before processing. SharePoint activities and File activities always display a 0 in this column. The size of the data source after processing. For Management activities, this value may be the same as the Size Before value if the mail system does not compress or shrink the mailbox after EMC SourceOne processing occurs. SharePoint activities and File activities always display a 0 in this column. Data Source Processing report 139

140 Running EMC SourceOne Reports Management Activity dashboard The Management Activity dashboard shows statistics, trends, and comparisons about commonly-used EMC SourceOne Management activities for a specified period of time. Note: This dashboard shows processing metrics from the front-end SourceOne Activity database, not archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct. Prerequisites: Management Activity dashboard The Management Activity dashboard is not an audit report, so no auditing configuration is required. The report shows information that is always captured in the EMC SourceOne Activity database, including data that was captured before you installed EMC SourceOne 6.8 or later. Procedure: Management Activity dashboard To run the Management Activity dashboard: 1. Access the Management Activity dashboard (Home > EMC SourceOne > System Reports > Management Activity Dashboard), as described in Accessing EMC SourceOne reports on page Specify report criteria, as described in Specifying criteria for the Management Activity dashboard on page Click View Report to generate the report based on your criteria. 4. To interpret the report, refer to Understanding the Management Activity dashboard on page 142 and Drill through to Data Source Processing report from Dashboard on page 152. Specifying criteria for the Management Activity dashboard To specify report criteria for the Management Activity dashboard: 1. Select an activity: 140 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

141 Running EMC SourceOne Reports Summary (default; summary of Journal, Historical Archive, PST/NSF Archive, and User Directed Archive activities) Journal Historical Archive PST/NSF Archive User Directed Archive 2. Select a time period: Today (default) This Week (starts on Monday) This Month This Quarter This Year 3. Select a view: Documents (default) - Displays the numbers of processed, failed, duplicate, and discarded items for the selected activity and period. Mailboxes - Displays the size of processed mailboxes for the selected activity and period. Data - Displays the sizes of processed, failed, duplicate, and discarded items for the selected activity and period. Activities - Displays activity statistics for the selected activity for the last five periods. Jobs - Displays job statistics for the selected activity for the last five periods. Figure 82 Management Activity dashboard criteria The dashboard refreshes every time you click on a different activity or period. Management Activity dashboard 141

142 Running EMC SourceOne Reports Understanding the Management Activity dashboard The Management Activity dashboard displays statistics for the period and activity that you specified. The Report Data Time Zone is displayed in the upper right corner. It is the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. The view you selected determines which statistics to display. Refer to: Documents view on page 142 Mailboxes view on page 145 Data view on page 147 Activities view on page 148 Jobs view on page 151 Documents view In the Management Activity dashboard, the Documents view displays the number of processed, failed, duplicate, and discarded items for the selected activity and period. 142 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

143 Running EMC SourceOne Reports Figure 83 Example - Documents view, Management Activity dashboard Table 34 describes the information shown in the Documents view. Management Activity dashboard 143

144 Running EMC SourceOne Reports Table 34 Documents view Graph/section Documents graph Duplicate Ratio graph Document Throughput graph Description Shows the following information for a specific activity. Processed: The total number of items processed by the activity. Duplicate: The number of duplicate items in any folder at the time of processing. Failed: The number of items that failed to process successfully. Discarded: The number of items that were discarded because they did not match any archiving rules. Shows the percent of processed documents (always 100%) and the percent of duplicate documents. Shows the document processing rate per minute. The table below the graph lists the document processing rate per minute and the document processing rate per hour for the specified archive activity and period. The document processing rate per day is shown only if the actual time spent processing was greater than 24 hours. Otherwise, the value displayed is N/A (Not Available). In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x100, and the needle is at 19, then the rate is 1900 (19 x100) documents per minute. The calculated value is displayed in the box. Note: The document processing rate does not include time spent on jobs that processed zero (0) items. Document Failures graph Document Processing Trends section Shows the percent (%) and number of items that failed processing for the specified activity and period. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The bar graph shows the number of processed, duplicate, and failed items for each of the last five periods. The line graph shows the number of documents processed per minute for each of the last five periods. The table lists the period; processing rate; the number of processed, duplicate, discarded, and failed items; the percent duplicate; and the percent failed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend. 144 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

145 Running EMC SourceOne Reports Mailboxes view In the Management Activity dashboard, the Mailboxes view displays the count, size, and rate of processed mailboxes for the specified activity and period. Figure 84 Example - Mailboxes view, Management Activity dashboard Management Activity dashboard 145

146 Running EMC SourceOne Reports Table 35 describes the information shown in the Mailboxes view. Table 35 Mailboxes view Graph/section Mailboxes graph Avg. Mailbox Size Processed graph Mailbox Processing Times graph Description Shows the total number of mailboxes processed and the number of mailboxes having items that failed processing for the specified activity and period. Shows the average mailbox size (yellow pointer) and the maximum mailbox size (red rectangle) processed for the specified activity and period. Shows the average processing time per mailbox in minutes and the average number of documents processed per mailbox for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x10, and the needle is at 19, then the rate is 190 (19 x10) minutes per mailbox. The calculated value is displayed in the box. Note: The mailbox processing rate shown in Mailboxes view includes the time spent on jobs that processed zero (0) items. Mailbox Failures graph Mailbox Processing Trends section Shows the percent (%) and number of mailboxes that failed processing for the specified activity and period. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the number of mailboxes processed, and the average mailbox processing time in each of the last five periods. The table lists the period, the average mailbox processing time in minutes, the number of mailboxes processed, the number of mailboxes processed with failures, the average number of documents processed per mailbox, and the average mailbox size processed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend. 146 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

147 Running EMC SourceOne Reports Data view In the Management Activity dashboard, the Data view displays the size of items processed for the specified activity and period. Figure 85 Example - Data view, Management Activity dashboard Table 36 describes the information shown in the Data view. Table 36 Data view Graph/section Data graph Data Composition graph Data Throughput graph Description Shows the total size in gigabytes (GB) for each of processed items, duplicate items, and items with attachments for the specified activity and period. Shows the size of items as a percent: items without attachments, and items with attachments for the specified activity and period. Shows the data processing rate in megabytes (MB) per hour. The table shows the rate in megabytes per hour and per day for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x10, and the needle is at 19, then the rate is 190 (19 x10) MB per hour. The calculated value is displayed in the box. Management Activity dashboard 147

148 Running EMC SourceOne Reports Table 36 Data view Graph/section Size at Source graph Data Processing Trends section Activities view Description Shows the total size of mailboxes before and after processing, and the reduction in mailbox size both in units and as a percent (%) for the specified activity and period. The Before and After values may be the same if the mail system does not compress or shrink mailboxes after EMC SourceOne processing occurs. For PST files, pre-6.8 data will show a file size of 0. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the size of data processed, the size of duplicates, and the rate (MB processed per hour) for each of the last five periods. The table lists the period; processing rate in MB per hour; the size of data processed, the size of duplicates; and mailbox size before and after processing. A green arrow indicates a positive trend compared with the previous period (row). A red arrow indicates a negative trend. In the Management Activity dashboard, the Activities view displays: Statistics for the top ten activities based on the number of documents processed Statistics for specific activities for the last five periods For the Summary, the graph displays statistics grouped by activity type. 148 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

149 Running EMC SourceOne Reports Figure 86 Example - Activities view, Summary, Management Activity dashboard If you select a specific activity other than Summary, then the graph displays statistics grouped by named activity. Management Activity dashboard 149

150 Running EMC SourceOne Reports Figure 87 Example - Activities view, Historical Archive, Management Activity dashboard Table 37 describes the information shown in the Activities view. Table 37 Activities view Graph/section Top 10 Activities by Documents Processed section Description Displays information for the ten activities that processed the highest number of documents in the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. For each type of activity (Summary) or each named activity, the graph shows the number of documents processed, the number of duplicate documents, the number of failed documents, and the number of jobs processed. The table lists the period, the activity type, the name of each activity, the number of jobs processed, the number of failed jobs, the number of documents processed, the number of duplicate documents, the number of failed documents, the duration of the activity, and the time at which the last job completed for the activity. 150 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

151 Running EMC SourceOne Reports Jobs view In the Management Activity dashboard, the Jobs view displays job statistics for the specified activity and period. Click the plus sign (+) next to the title of the Job Trends - Last 5 Periods Processed graph to see the associated table. Figure 88 Example - Jobs view, Management Activity dashboard Table 38 describes the information shown in the Jobs view. Table 38 Jobs view Graph/section Jobs graph Job Trends section Job Failures graph Description Shows the number of jobs processed and the number of failed jobs for the specified activity and period. Displays information for the last five periods in which processing occurred for the specified activity. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the number of jobs processed, the number of jobs failed, and the average job processing time in minutes. The average job time includes only the jobs that spent time processing. If a job did not spend any time processing, then it is not included in the average. The table lists each period, the number of jobs processed, the average job processing time in minutes, the number of failed jobs, and the percent (%) of failed jobs. Shows the percent (%) and number of failed jobs for the specified activity and period. Management Activity dashboard 151

152 Running EMC SourceOne Reports Drill through to Data Source Processing report from Dashboard In the Management Activity dashboard for any activity type except Summary, if the Detailed parameter is set to True, you can click on a blue number to drill through to the associated Data Source Processing report. For example, in the Documents view for the Historical Archive activity type, you can drill through the Processed value under the Documents graph or through the dates in the Document Processing Trends table. You can also click on the Documents graph or the Document Processing Trends graph. Figure 89 Example - Drill through enabled in Management Activity dashboard For information about the Data Source Processing report, refer to Understanding the Data Source Processing report on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

153 Running EMC SourceOne Reports Example: Drill through to list of processed PST files To see a list of the PST files processed by the PST Archive activity: 1. In the Management Activity dashboard: a. Select PST/NSF Archive. b. Select the period. c. Select one of the following views: Documents, Mailboxes, or Data. Figure 90 Example - Mailboxes view for a PST/NSF Activity report d. Click on a blue number to drill through to the Data Source processing report. Management Activity dashboard 153

154 Running EMC SourceOne Reports Figure 91 Example - Drill through to Data Source Processing report - PST/NSF Activity 2. In the Data Source Processing report, click on a blue number to see details for all of the PST files that were processed. Figure 92 Example - Drill through to PST/NSF Archive Process details 154 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

155 Running EMC SourceOne Reports Search Activity dashboard The Search Activity dashboard shows statistics about the following EMC SourceOne Search and Discovery Manager jobs for the specified period of time: EMC SourceOne Search - search, copy, and restore jobs Discovery Manager - search, copy, and export jobs It shows statistics for all users, including audited users and non-audited users. Prerequisites: Search Activity dashboard By default, the Administrator search type is always audited, and so Search Activity dashboards always include that information. No configuration is required. If you want to be able to drill through the Search Activity dashboard to the Search Activity audit report, then you must configure audited users, as described in the EMC SourceOne Management Administration Guide, "Configuring Applications and Web Services" > Auditing Search operations. Procedure: Search Activity dashboard To run the Search Activity dashboard: 1. Access the Search Activity Dashboard report (Home > EMC SourceOne > System Reports > Search Activity Dashboard), as described in Accessing EMC SourceOne reports on page Enter report criteria, as described in Specifying criteria for the Search Activity dashboard on page Click View Report to generate the report based on your criteria. 4. To interpret the dashboard, refer to Understanding the Search Activity dashboard on page 157 and Drill through to the Search Activity report for Search on page 160. Specifying criteria for the Search Activity dashboard To specify report criteria for the Search Activity dashboard: 1. Select a search activity: Search Activity dashboard 155

156 Running EMC SourceOne Reports Summary (summary of all search activities; default) Web Search - Searches performed in EMC SourceOne Search Web Copy & Restore - Copy operations and restore operations performed in EMC SourceOne Search DM Search - Searches performed in EMC SourceOne Discovery Manager DM Export & Copy - Export operations and copy operations performed in EMC SourceOne Discovery Manager 2. Select a time period: Today (default) This Week (starts on Monday) This Month This Quarter This Year 3. Select a view: Jobs (default) Trends Composition (available only for the Summary activity type) Figure 93 Search Activity dashboard criteria The dashboard refreshes every time you select new criteria. 156 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

157 Running EMC SourceOne Reports Understanding the Search Activity dashboard The Search Activity dashboard report shows statistics about EMC SourceOne search jobs and activities for the period and activity type that you specified. It shows statistics for all users, including audited users and non-audited users. The upper right corner of the dashboard displays the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. The view you selected determines which statistics to display. Refer to: Jobs view on page 157 Trends view on page 158 Composition view on page 159 Jobs view The Jobs view displays job statistics for the specified period and type of search activity. Figure 94 Example - Jobs view, Search Activity dashboard Search Activity dashboard 157

158 Running EMC SourceOne Reports Table 39 describes the information shown in the Jobs view. Table 39 Jobs view Graph/section Jobs graph Documents graph Execution Times graph Jobs Failures Trends view Description Shows the number of submitted, completed, and failed jobs for the specified search activity and period. Shows the number of processed and failed documents for the specified search activity and period. Shows the average execution time in seconds and the average number of jobs submitted per day for the specified search activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x1, and the needle is at 19, then the average execution rate is 19 (19 x 1) seconds. The calculated value is displayed in the box. Shows the number and percent (%) of failed jobs. The Trends view shows job statistics for the last five periods during which processing occurred for the specified type of search activity. Figure 95 Example - Trends view, Search Activity dashboard Table 40 describes the information shown in the Trends view. Table 40 Trends view Graph/section Job Processing Trends section Description Displays job processing trends for the last five periods in which the specified search activity occurred. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the number of jobs submitted, the number of jobs that failed, and the average job execution time in seconds. The table shows the period; the average job execution time in seconds; the numbers of submitted, completed, and failed jobs; and the percent (%) of failed jobs. A green arrow indicates an improvement in execution time compared with the previous period (row). A red arrow indicates a negative trend. 158 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

159 Running EMC SourceOne Reports Composition view The Composition view is available when you select Summary as the activity type. It is not available for other activity types. The Composition view shows the number and percent of jobs for each type of search activity, and the percent of each type of search user for the specified period. Figure 96 Example - Composition view, Search Activity dashboard Table 41 describes the information shown in the Composition view. Table 41 Composition view Graph/section Activity Type Composition graph Job Trends by Type graph User Type Composition graph Description Shows the percent (%) of each search activity type for the specified period. Shows the number of submitted search jobs by the type of search activity, and the average time it took to complete searches in the EMC SourceOne Web Search application for the last five periods. Shows the percent (%) of activities performed by each search role for the specified period. Refer to Search roles for SourceOne Search reports on page 19. User searches are purged periodically from the system, so the composition graph may change even if no new searches are performed. For example, the composition graph may show an increase in the ratio of Administrator searches to user searches after user searches are purged, even if no new Administrator searches have been performed. Search Activity dashboard 159

160 Running EMC SourceOne Reports Drill through to the Search Activity report for Search In the Search Activity dashboard for the Web Search activity type only, you can click on a blue number to drill through to the associated Search Activity report. You can drill through from the Jobs view or the Trends view. Figure 97 Example - Web Search activity type, Search Activity dashboard Note: Since the Search Activity dashboard shows statistics for all users, including audited users and non-audited users, the counts may not match those shown on the Search Activity audit report. For information about the Search Activity report, refer to Understanding the Search Activity report (Search) on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

161 Running EMC SourceOne Reports SharePoint Management Activity Dashboard The SharePoint Management Activity dashboard shows statistics, trends, and comparisons about the EMC SourceOne for Microsoft SharePoint archive activities for a specified period of time. Note: This dashboard shows SharePoint processing metrics from the front-end Activity database, not archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct. Prerequisites: SharePoint Management Activity Dashboard EMC SourceOne for Microsoft SharePoint 7.0 must be installed on your SourceOne 7.0 system. The SharePoint Management Activity dashboard is not an audit report, so no auditing configuration is required. The report shows information that is always captured in the EMC SourceOne Activity database, including SharePoint data that is captured starting with EMC SourceOne 7.0 and EMC SourceOne for Microsoft SharePoint 7.0. Procedure: SharePoint Management Activity dashboard To run the SharePoint Management Activity dashboard: 1. Access the SharePoint Management Activity dashboard (Home > EMC SourceOne > System Reports > SharePoint Management Activity Dashboard), as described in Accessing EMC SourceOne reports on page Enter report criteria, as described in Procedure: SharePoint Management Activity dashboard on page Click View Report to generate the report based on your criteria. 4. To interpret the report, refer to Understanding the SharePoint Management Activity Dashboard on page 163 and Drill through to Data Source Processing report from SharePoint Dashboard on page 172. SharePoint Management Activity Dashboard 161

162 Running EMC SourceOne Reports Specifying criteria for the SharePoint Management Activity dashboard To specify report criteria for the SharePoint Management Activity dashboard: 1. Select an activity: Summary (default; summary of SharePoint Archive and SharePoint Online Archive activities) SharePoint Archive SharePoint Online Archive 2. Select a time period: Today (default) This Week (starts on Monday) This Month This Quarter This Year 3. Select a view: Items (default) - Displays the numbers of processed, failed, duplicate, and discarded items for the selected activity and period. Data Sources - Displays the size of processed data sources for the selected activity and period. Data - Displays the sizes of processed, failed, duplicate, and discarded items for the selected activity and period. Activities - Displays activity statistics for the selected activity for the last five periods. Jobs - Displays job statistics for the selected activity for the last five periods. Figure 98 SharePoint Management Activity Dashboard criteria The dashboard refreshes every time you click on a different activity or period. 162 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

163 Running EMC SourceOne Reports Understanding the SharePoint Management Activity Dashboard The SharePoint Management Activity Dashboard displays statistics for the period and activity that you specified. The Report Data Time Zone is displayed in the upper right corner. It is the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. The view you selected determines which statistics to display. Refer to: Items view - SharePoint Management Activity Dashboard on page 163 Data Sources view - SharePoint Management Activity Dashboard on page 166 Data view - SharePoint Management Activity Dashboard on page 168 Activities view - SharePoint Management Activity Dashboard on page 169 Jobs view - SharePoint Management Activity Dashboard on page 171 Items view - SharePoint Management Activity Dashboard In the SharePoint Management Activity Dashboard, the Items view displays the number of processed, failed, duplicate, and discarded items for the selected activity and period. SharePoint Management Activity Dashboard 163

164 Running EMC SourceOne Reports Figure 99 Example - Items view, SharePoint Management Activity Dashboard The following table describes the information shown in the Items view. 164 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

165 Running EMC SourceOne Reports Table 42 Items view - SharePoint Management Activity Dashboard Graph/section Items graph Duplicate Ratio graph Item Throughput graph Description Shows the following information for a specific activity. Processed: The total number of items processed by the activity. Duplicate: The number of duplicate items in any folder at the time of processing. Failed: The number of items that failed to process successfully. Discarded: The number of items that were discarded because they did not match any archiving rules. Shows the percent of processed items (always 100%) and the percent of duplicate items. Shows the item processing rate per minute. The table below the graph lists the item processing rate per minute and the item processing rate per hour for the specified archive activity and period. The item processing rate per day is shown only if the actual time spent processing was greater than 24 hours. Otherwise, the value displayed is N/A (Not Available). In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x100, and the needle is at 19, then the rate is 1900 (19 x100) items per minute. The calculated value is displayed in the box. Note: The item processing rate does not include time spent on jobs that processed zero (0) items. Item Failures graph Item Processing Trends section Shows the percent (%) and number of items that failed processing for the specified activity and period. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The bar graph shows the number of processed, duplicate, and failed items for each of the last five periods. The line graph shows the number of items processed per minute for each of the last five periods. The table lists the period; processing rate; the number of processed, duplicate, discarded, and failed items; the percent duplicate; and the percent failed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend. SharePoint Management Activity Dashboard 165

166 Running EMC SourceOne Reports Data Sources view - SharePoint Management Activity Dashboard In the SharePoint Management Activity Dashboard, the Data Sources view displays the count, size, and rate of processed data sources for the specified activity and period. Figure 100 Example - Data Sources view, SharePoint Management Activity Dashboard 166 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

167 Running EMC SourceOne Reports The following table describes the information shown in the Data Sources view. Table 43 Data Sources view - SharePoint Management Activity Dashboard Graph/section Data Sources graph Avg. Data Source Size Processed graph Data Source Processing Times graph Description Shows the total number of data sources processed and the number of data sources having items that failed processing for the specified activity and period. Shows the average data source size (yellow pointer) and the maximum data source size (red rectangle) processed for the specified activity and period. Shows the average processing time per data source in minutes and the average number of documents processed per data source for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x10, and the needle is at 19, then the rate is 190 (19 x10) minutes per data source. The calculated value is displayed in the box. Note: The data source processing rate shown in Data Sources view includes the time spent on jobs that processed zero (0) items. Data Source Failures graph Data Source Processing Trends section Shows the percent (%) and number of data sources that failed processing for the specified activity and period. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the number of data sources processed, and the average data source processing time in each of the last five periods. The table lists the period, the average data source processing time in minutes, the number of data sources processed, the number of data sources processed with failures, the average number of items processed per data source, and the average data source size processed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend. SharePoint Management Activity Dashboard 167

168 Running EMC SourceOne Reports Data view - SharePoint Management Activity Dashboard In the SharePoint Management Activity Dashboard, the Data view displays the size of items processed for the specified activity and period. Figure 101 Example - Data view, SharePoint Management Activity Dashboard The following table describes the information shown in the Data view. Table 44 Data view - SharePoint Management Activity Dashboard Graph/section Data graph Data Composition graph Data Throughput graph Description Shows the total size for each of processed items, duplicate items, and items with attachments for the specified activity and period. Shows the size of items as a percent: items without attachments, and items with attachments for the specified activity and period. Shows the data processing rate in megabytes (MB) per hour. The table shows the rate in megabytes per hour and per day for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x10, and the needle is at 19, then the rate is 190 (19 x10) MB per hour. The calculated value is displayed in the box. 168 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

169 Running EMC SourceOne Reports Table 44 Data view - SharePoint Management Activity Dashboard Graph/section Size at Source graph Data Processing Trends section Description Not applicable for SharePoint archive activities. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the size of data processed, the size of duplicates, and the rate (MB processed per hour) for each of the last five periods. The table lists the period; processing rate in MB per hour; the size of data processed, and the size of duplicates. The Size Before and Size After columns do not apply to SharePoint archive activities. A green arrow indicates a positive trend compared with the previous period (row). A red arrow indicates a negative trend. Activities view - SharePoint Management Activity Dashboard In the SharePoint Management Activity dashboard, the Activities view displays: Statistics for the top ten activities based on the number of items processed Statistics for specific activities for the last five periods For the Summary, the graph displays statistics grouped by activity type. Figure 102 Example - Activities view, Summary, SharePoint Management Activity Dashboard SharePoint Management Activity Dashboard 169

170 Running EMC SourceOne Reports If you select a specific activity other than Summary, then the graph displays statistics grouped by named activity. Figure 103 Example - Activities view, SharePoint Archive, SharePoint Management Activity Dashboard The following table describes the information shown in the Activities view. Table 45 Activities view - SharePoint Management Activity Dashboard Graph/section Top 10 Activities by Items Processed section Description Displays information for the ten activities that processed the highest number of items in the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. For each type of activity (Summary) or each named activity, the graph shows the number of items processed, the number of duplicate items, the number of failed items, and the number of jobs processed. The table lists the period, the activity type, the name of each activity, the number of jobs processed, the number of failed jobs, the number of items processed, the number of duplicate items, the number of failed items, the duration of the activity, and the time at which the last job completed for the activity. 170 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

171 Running EMC SourceOne Reports Jobs view - SharePoint Management Activity Dashboard In the SharePoint Management Activity dashboard, the Jobs view displays job statistics for the specified activity and period. Click the plus sign (+) next to the title of the Job Trends - Last 5 Periods Processed graph to see the associated table. Figure 104 Example - Jobs view, SharePoint Management Activity Dashboard The following table describes the information shown in the Jobs view. Table 46 Jobs view - SharePoint Management Activity Dashboard Graph/section Jobs graph Job Trends section Job Failures graph Description Shows the number of jobs processed and the number of failed jobs for the specified activity and period. Displays information for the last five periods in which processing occurred for the specified activity. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the number of jobs processed, the number of jobs failed, and the average job processing time in minutes. The average job time includes only the jobs that spent time processing. If a job did not spend any time processing, then it is not included in the average. The table lists each period, the number of jobs processed, the average job processing time in minutes, the number of failed jobs, and the percent (%) of failed jobs. Shows the percent (%) and number of failed jobs for the specified activity and period. SharePoint Management Activity Dashboard 171

172 Running EMC SourceOne Reports Drill through to Data Source Processing report from SharePoint Dashboard In the SharePoint Management Activity Dashboard for any activity type except Summary, if the Detailed parameter is set to True, you can click on a blue number to drill through to the associated Data Source Processing report. For example, in the Items view for the SharePoint Archive activity type, you can drill through the Processed value under the Items graph or through the dates in the Item Processing Trends table. You can also click on the Items graph or the Item Processing Trends graph. Figure 105 Example - Drill through enabled in SharePoint Management Activity Dashboard For information about the Data Source Processing report, refer to Understanding the Data Source Processing report on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

173 Running EMC SourceOne Reports Files Management Activity Dashboard The Files Management Activity dashboard shows statistics, trends, and comparisons about the EMC SourceOne for File Systems activities (File Archive - Historical, File Delete - Historical, and File Removal) for a specified period of time. Note: This dashboard shows file processing metrics from the front-end Activity database, not archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct. Prerequisites: Files Management Activity Dashboard EMC SourceOne for File Systems 6.8 or later must be installed on your SourceOne 7.0 system. The Files Management Activity dashboard is not an audit report, so no auditing configuration is required. The report shows information that is always captured in the EMC SourceOne Activity database, including files data that is captured starting with EMC SourceOne 7.0 and EMC SourceOne for File Systems 6.8. Procedure: Files Management Activity dashboard To run the Files Management Activity dashboard: 1. Access the Files Management Activity dashboard (Home > EMC SourceOne > System Reports > Files Management Activity Dashboard), as described in Accessing EMC SourceOne reports on page Enter report criteria, as described in Specifying criteria for the Files Management Activity dashboard on page Click View Report to generate the report based on your criteria. 4. To interpret the report, refer to Understanding the Files Management Activity Dashboard on page 175 and Drill through to Data Source Processing report from Files Dashboard on page 184. Files Management Activity Dashboard 173

174 Running EMC SourceOne Reports Specifying criteria for the Files Management Activity dashboard To specify report criteria for the Files Management Activity dashboard: 1. Select an activity: Summary (default; summary of File Archive - Historical, File Delete - Historical, and File Removal activities) File Archive - Historical File Delete - Historical File Removal 2. Select a time period: Today (default) This Week (starts on Monday) This Month This Quarter This Year 3. Select a view: Files (default) - Displays the numbers of processed, failed, duplicate, and discarded files for the selected activity and period. File Shares - Displays the size of processed file shares for the selected activity and period. Data - Displays the sizes of processed, failed, duplicate, and discarded files for the selected activity and period. Activities - Displays activity statistics for the selected activity for the last five periods. Jobs - Displays job statistics for the selected activity for the last five periods. Figure 106 Files Management Activity Dashboard criteria The dashboard refreshes every time you click on a different activity or period. 174 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

175 Running EMC SourceOne Reports Understanding the Files Management Activity Dashboard The Files Management Activity Dashboard displays statistics for the period and activity that you specified. The Report Data Time Zone is displayed in the upper right corner. It is the time zone in which the Activity database SQL Server resides, not the time zone of the client computer. The view you selected determines which statistics to display. Refer to: Files view - Files Management Activity Dashboard on page 175 File Shares view - Files Management Activity Dashboard on page 178 Data view - Files Management Activity Dashboard on page 180 Activities view - Files Management Activity Dashboard on page 181 Jobs view - Files Management Activity Dashboard on page 183 Files view - Files Management Activity Dashboard In the Files Management Activity Dashboard, the Files view displays the number of processed, failed, duplicate, and discarded files for the selected activity and period. Files Management Activity Dashboard 175

176 Running EMC SourceOne Reports Figure 107 Example - Files view, Files Management Activity Dashboard The following table describes the information shown in the Files view. 176 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

177 Running EMC SourceOne Reports Table 47 Files view - Files Management Activity Dashboard Graph/section Files graph Duplicate Ratio graph Files Throughput graph Description Shows the following information for a specific activity. Processed: The total number of files processed by the activity. Duplicate: The number of duplicate files in any folder at the time of processing. Failed: The number of files that failed to process successfully. Discarded: The number of files that were discarded because they did not match any archiving rules. Shows the percent of processed items (always 100%) and the percent of duplicate files. Shows the file processing rate per minute. The table below the graph lists the file processing rate per minute and the file processing rate per hour for the specified activity and period. The item processing rate per day is shown only if the actual time spent processing was greater than 24 hours. Otherwise, the value displayed is N/A (Not Available). In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x100, and the needle is at 19, then the rate is 1900 (19 x100) files per minute. The calculated value is displayed in the box. Note: The file processing rate does not include time spent on jobs that processed zero (0) files. File Failures graph File Processing Trends section Shows the percent (%) and number of files that failed processing for the specified activity and period. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The bar graph shows the number of processed, duplicate, and failed ifiles for each of the last five periods. The line graph shows the number of files processed per minute for each of the last five periods. The table lists the period; processing rate; the number of processed, duplicate, discarded, and failed files; the percent duplicate; and the percent failed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend. Files Management Activity Dashboard 177

178 Running EMC SourceOne Reports File Shares view - Files Management Activity Dashboard In the Files Management Activity Dashboard, the File Shares view displays the count, size, and rate of processed file shares for the specified activity and period. Figure 108 Example - File Shares view, Files Management Activity Dashboard 178 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

179 Running EMC SourceOne Reports The following table describes the information shown in the Data Sources view. Table 48 File Shares view - Files Management Activity Dashboard Graph/section File Shares graph Avg. File Share Size Processed graph File Share Processing Times graph Description Shows the total number of file shares processed and the number of file shares having files that failed processing for the specified activity and period. Shows the average file share size (yellow pointer) and the maximum file share size (red rectangle) processed for the specified activity and period. Shows the average processing time per file share in minutes and the average number of files processed per file share for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x10, and the needle is at 19, then the rate is 190 (19 x10) minutes per file share. The calculated value is displayed in the box. Note: The file share processing rate shown in File Shares view includes the time spent on jobs that processed zero (0) items. File Share Failures graph File Share Processing Trends section Shows the percent (%) and number of file shares that failed processing for the specified activity and period. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the number of file shares processed, and the average file share processing time in each of the last five periods. The table lists the period, the average file share processing time in minutes, the number of file shares processed, the number of file shares processed with failures, the average number of files processed per file share, and the average file share size processed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend. Files Management Activity Dashboard 179

180 Running EMC SourceOne Reports Data view - Files Management Activity Dashboard In the Files Management Activity Dashboard, the Data view displays the size of items processed for the specified activity and period. Figure 109 Example - Data view, Files Management Activity Dashboard The following table describes the information shown in the Data view. Table 49 Data view - Files Management Activity Dashboard Graph/section Data graph Description Shows the total size for each of processed files, duplicate files, and completed files for the specified activity and period. For File Archive or File Delete activities: "Processed" refers to the files that were handled by the activity. "Duplicate" refers to files that were already archived including from another location. It is not applicable for File Delete activities. "Completed" refers to files that were successfully archived or deleted from the file system. For File Removal activities: "Processed" refers to the virtual file locations processed for cleanup from the database. "Duplicate" is not applicable. "Completed" refers to virtual files that were deleted from the database. 180 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

181 Running EMC SourceOne Reports Table 49 Data view - Files Management Activity Dashboard Graph/section Data Composition graph Data Throughput graph Size at Source graph Data Processing Trends section Description Shows the size of files as a percent: processed files, and completed files for the specified activity and period. Not applicable for File Removal activities. Shows the data processing rate in megabytes (MB) per hour. The table shows the rate in megabytes per hour and per day for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is x10, and the needle is at 19, then the rate is 190 (19 x10) MB per hour. The calculated value is displayed in the box. Not applicable for SharePoint archive activities and File activities. Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the size of data processed, the size of duplicates, and the rate (MB processed per hour) for each of the last five periods. The table lists the period; processing rate in MB per hour; the size of data processed, and the size of duplicates. The Size Before and Size After columns do not apply to SharePoint archive activities and Files activities. A green arrow indicates a positive trend compared with the previous period (row). A red arrow indicates a negative trend. Activities view - Files Management Activity Dashboard In the Files Management Activity dashboard, the Activities view displays: Statistics for the top ten activities based on the number of items processed Statistics for specific activities for the last five periods For the Summary, the graph displays statistics grouped by activity type. If you select a specific activity other than Summary, then the graph displays statistics grouped by named activity. Files Management Activity Dashboard 181

182 Running EMC SourceOne Reports Figure 110 Example - Activities view, File Archive - Historical, Files Management Activity Dashboard The following table describes the information shown in the Activities view. Table 50 Activities view - Files Management Activity Dashboard Graph/section Top 10 Activities by Files Processed section Description Displays information for the ten activities that processed the highest number of files in the last five periods in which processing occurred, ordered by the sum of the processed file count. If no processing occurred in a period, then that period is not displayed in this section. For each type of activity (Summary) or each named activity, the graph shows the sum of files processed, the sum of duplicate files, the sum of failed files, and the sum of jobs processed. The table lists the period, the activity type, the name of each activity, the number of jobs processed, the number of failed jobs, the number of ifiles processed, the number of duplicate files, the number of failed files, the duration of the activity, and the time at which the last job completed for the activity. 182 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

183 Running EMC SourceOne Reports Jobs view - Files Management Activity Dashboard In the Files Management Activity dashboard, the Jobs view displays job statistics for the specified activity and period. Click the plus sign (+) next to the title of the Job Trends - Last 5 Periods Processed graph to see the associated table. Figure 111 Example - Jobs view, Files Management Activity Dashboard The following table describes the information shown in the Jobs view. Table 51 Jobs view - Files Management Activity Dashboard Graph/section Jobs graph Job Trends section Job Failures graph Description Shows the number of jobs processed and the number of failed jobs for the specified activity and period. Displays information for the last five periods in which processing occurred for the specified activity. If no processing occurred in a period, then that period is not displayed in this section. The graph shows the number of jobs processed, the number of jobs failed, and the average job processing time in minutes. The average job time includes only the jobs that spent time processing. If a job did not spend any time processing, then it is not included in the average. The table lists each period, the number of jobs processed, the average job processing time in minutes, the number of failed jobs, and the percent (%) of failed jobs. Shows the percent (%) and number of failed jobs for the specified activity and period. Files Management Activity Dashboard 183

184 Running EMC SourceOne Reports Drill through to Data Source Processing report from Files Dashboard In the Files Management Activity Dashboard for any activity type except Summary, if the Detailed parameter is set to True, you can click on a blue number to drill through to the associated Data Source Processing report. For information about the Data Source Processing report, refer to Understanding the Data Source Processing report on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

185 7 Running EMC Discovery Manager Reports This chapter describes how to access and viewdiscovery Manager reports. Note: To export and print reports, refer to Working with reports on page 26. This chapter includes the following topics: Accessing Discovery Manager reports Search Activity report (Discovery Manager) Assign to Hold Folder report (Discovery Manager) Delete from Hold Folder report (Discovery Manager) Documents Viewed report (Discovery Manager) Export Activity report (Discovery Manager) Running EMC Discovery Manager Reports 185

186 Running EMC Discovery Manager Reports Accessing Discovery Manager reports To access Discovery Manager reports: 1. In Internet Explorer 7.0 or higher, enter the URL for your SQL Server 2008, 2008 R2, or 2012 Reporting Services, as provided by your system administrator. The SQL Server Reporting Services home page opens. It displays the EMC Discovery Manager folder. If EMC SourceOne reports are installed, then the EMC SourceOne folder is also displayed. Figure 112 EMC Discovery Manager folder on SQL Server 2008 R2 Reporting Services home page 2. Click the Discovery Manager folder to open it. The Discovery Manager page displays the Search Audit Reports subfolder. Figure 113 EMC Discovery Manager reports - Search Audit Reports subfolder 3. Open the Search Audit Reports subfolder to access the reports. 186 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

187 Running EMC Discovery Manager Reports Figure 114 EMC Discovery Manager reports on SQL Server 2008 Reporting Services 4. To run a report, refer to: Search Activity report (Discovery Manager) on page 188 Assign to Hold Folder report (Discovery Manager) on page 195 Delete from Hold Folder report (Discovery Manager) on page 201 Documents Viewed report (Discovery Manager) on page 207 Export Activity report (Discovery Manager) on page 214 Accessing Discovery Manager reports 187

188 Running EMC Discovery Manager Reports Search Activity report (Discovery Manager) The Discovery Manager Search Activity report lists the collection searches that were performed by users in the Discovery Manager client or with the DMCollect utility. Note: Discovery Manager search operations that are incomplete will be partially audited, but will not be included in reports. Prerequisite: Search Activity report (Discovery Manager) Collection searches are always audited. No auditing configuration is required. Considerations: Search Activity Report (Discovery Manager) Refer to Considerations for Discovery Manager reports on page 24. Procedure: Search Activity report (Discovery Manager) To run the Search Activity report for Discovery Manager: 1. Access the Search Activity report (Home > EMC Discovery Manager > Search Audit Reports > Search Activity Report), as described in Accessing Discovery Manager reports on page Enter report parameters, as described in Specifying parameters for Search Activity report (Discovery Manager) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Search Activity report (Discovery Manager) on page 191. Specifying parameters for Search Activity report (Discovery Manager) Specify parameters for the Discovery Manager > Search Audit Reports > Search Activity report as described in Table EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

189 Running EMC Discovery Manager Reports Figure 115 Example - default parameters for Search Activity (Discovery Manager) report To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. Table 52 Search Activity (Discovery Manager) report parameters Parameter Begin Date End Date Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Search Activity report (Discovery Manager) 189

190 Running EMC Discovery Manager Reports Table 52 Search Activity (Discovery Manager) report parameters (continued) Parameter Period User Matter Description To specify a period of time, select an option in the Period field: Today Yesterday Last 24 Hours This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year All Dates Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. The User field lists the names of all Discovery Manager users. To specify the search user, select an option in the User field: All (default) The name of a Discovery Manager user The list of matters depends on what you selected in the User field: If you selected All in the User field, then the Matter field lists the names of all matters that have ever had a search executed in Discovery Manager. If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had a search executed by the selected user in Discovery Manager. Note: If a matter was renamed, and if searches were executed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all searches associated with a specific matter ID will be displayed in report results. To specify the matter, select an option in the Matter field: All (default) The name of a Discovery Manager matter Matter Details Expand All Groups Select one of the Matter Details options: True (default) - Displays the Matter Details section when you expand a row in the report. Refer to Matter Details on page 194 for a description. False - Does not display the Matter Details section when you expand a row in the report. Select one of the Expand All Groups options: True - Expands all rows and sections to display details. False (default) - Does not expand all rows and sections. 190 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

191 Running EMC Discovery Manager Reports Understanding the Search Activity report (Discovery Manager) This section describes the information displayed in the Search Activity report for Discovery Manager. Times are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer. Figure 116 Example - Search Activity report (Discovery Manager) Figure 117 Example - Search Activity report (Discovery Manager) - details For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Search Activity report (Discovery Manager) 191

192 Running EMC Discovery Manager Reports Body of report The first row shows totals for some columns. Table 53 Body of Search Activity report (Discovery Manager) Column Date User Folders Search Terms SearchID Archive Hits Displayed Hits Description The date on which the collection search was performed. The name of the Discovery Manager user who performed the search. The names of the EMC SourceOne mapped folders that were searched. The search criteria. If the user did not specify criteria, then the Search Terms column displays Date <= The internal ID of the collection search. The number of items in the SourceOne archive that matched search criteria. The number of matching items displayed in search results. Note: The number of Displayed Hits may not match the number of Archived Hits. Refer to Considerations for Discovery Manager reports on page 24. Search Operation Details To see details for a search operation, expand the row by clicking the plus sign (+) next to the date. Table 54 Search Operation Details in Search Activity report (Discovery Manager) Column Date User Description The date on which the collection search was performed. The name of the Discovery Manager user who performed the collection search. Note: In SourceOne 7.0, this name is the Windows SID of the user. In SourceOne 6.8.1, this name was the canonical address of the user in the mail system. Search ID Search Name Search Type Archive Hits The internal ID of the collection search. The name of the collection search, as displayed in the navigation pane. In this release, the Search Type is always Collection. The number of items in the SourceOne archive that matched search criteria. 192 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

193 Running EMC Discovery Manager Reports Table 54 Search Operation Details in Search Activity report (Discovery Manager) (continued) Column Displayed Hits Description The number of matching items displayed in search results. Note: The number of Displayed Hits may not match the number of Archived Hits. Refer to Considerations for Discovery Manager reports on page 24. Maximum Hits Requested Search Full Text Indexes Folders Searched Search Terms Enhanced Xtender Duplicate Tracking The maximum number of search results. The Discovery Manager Application Administrator specifies the global default in the Maximum Search Hits option in Discovery Manager Configuration settings. The Discovery Manager user can change this value for a specific search in the Max Search Results field in the Search Properties dialog box The Discovery Manager Application Administrator specifies the global default in the Search Full Text Indexes option in Discovery Manager Configuration settings. Refer to "Configuring Discovery Manager" in the EMC SourceOne Discovery Manager User Guide. The Discovery Manager user can change this value for a specific search in the "Always search full text indexes" option of the Search Properties dialog box. Refer to "Editing search properties" in the EMC SourceOne Discovery Manager User Guide. Values: True = Performed a full-text index search. False = Performed a relational search. The names of the EMC SourceOne mapped folders that were searched. The search criteria. If theuser did not specify criteria, then the Search Terms field displays Date <= In Discovery Manager Configuration settings, the Discovery Manager Application Administrator specifies whether or not Xtender duplicate messages are tracked. Refer to "Configuring Discovery Manager" in the EMC SourceOne Discovery Manager User Guide. Values: True = Xtender duplicate messages are tracked in the Discovery Manager client and can be displayed. False = Xtender duplicate messages are not tracked in the Discovery Manager client. Search Activity report (Discovery Manager) 193

194 Running EMC Discovery Manager Reports Matter Details To see matter details for a collection search: 1. In the report parameters, select Matter Details: True. 2. Expand the row by clicking the plus sign (+) next to the date. Table 55 Matter Details (Discovery Manager) Column Name Last Modified Matter ID Hold Folder Collection Sources Custodians Keywords Custom Metadata Description The name of the matter associated with the operation. The date and time on which the matter was last modified. The internal ID of the matter. The name of the hold folder specified in matter properties. The names of the EMC SourceOne mapped folders specified as search folders in matter properties. The names of custodians specified in matter properties. The keywords specified in matter properties. The custom metadata specified in matter properties. 194 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

195 Running EMC Discovery Manager Reports Assign to Hold Folder report (Discovery Manager) The Assign to Hold Folder report lists the Assign Results to Matter operations that were performed in matters associated with a hold folder. Note: Hold folders and the Assign Results to Matter operation are available in the full edition of Discovery Manager. Prerequisite: Assign to Hold Folder report (Discovery Manager) Assign to hold folder operations are always audited. No auditing configuration is required. Considerations: Assign to Hold Folder report (Discovery Manager) Refer to Considerations for Discovery Manager reports on page 24. Procedure: Assign to Hold Folder report (Discovery Manager) To run the Assign to Hold Folder report for Discovery Manager: 1. Access the Assign to Hold Folder report (Home > EMC Discovery Manager > Search Audit Reports > Assign to Hold Folder Report), as described in Accessing Discovery Manager reports on page Enter report parameters, as described in Specifying parameters for Assign to Hold Folder report (Discovery Manager) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Assign to Hold Folder report (Discovery Manager) on page 198. Specifying parameters for Assign to Hold Folder report (Discovery Manager) Specify parameters for the Discovery Manager > Search Audit Reports > Assign to Hold Folder report as described in Table 56 on page 196. Assign to Hold Folder report (Discovery Manager) 195

196 Running EMC Discovery Manager Reports Figure 118 Example - default parameters for Assign to Hold Folder report (Discovery Manager) To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. Table 56 Assign to Hold Folder (Discovery Manager) report parameters Parameter Begin Date End Date Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. 196 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

197 Running EMC Discovery Manager Reports Table 56 Assign to Hold Folder (Discovery Manager) report parameters Parameter Period User Matter Description To specify a period of time, select an option in the Period field: Today Yesterday Last 24 Hours This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year All Dates Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. The User field lists the names of all Discovery Manager users. To specify the user, select an option in the User field: All (default) The name of a Discovery Manager user The list of matters depends on what you selected in the User field: If you selected All in the User field, then the Matter field lists the names of all matters that have ever had an assign to hold folder operation performed in Discovery Manager. If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had an assign to hold folder operation performed by the selected user in Discovery Manager. Note: If a matter was renamed, and if assign to hold folder operations were performed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all assign to hold folder operations associated with a specific matter ID will be displayed in report results. To specify the matter, select an option in the Matter field: All (default) The name of a Discovery Manager matter Matter Details Select one of the Matter Details options: True (default) - Displays the Matter Details section when you expand a row in the report. False - Does not display the Matter Details section when you expand a row in the report. Assign to Hold Folder report (Discovery Manager) 197

198 Running EMC Discovery Manager Reports Table 56 Assign to Hold Folder (Discovery Manager) report parameters Parameter Expand All Groups Description Select one of the Expand All Groups options: True - Expands all rows and sections to display details. False (default) - Does not expand all rows and sections. Understanding the Assign to Hold Folder report (Discovery Manager) This section describes the information displayed in the Assign to Hold Folder report for Discovery Manager. Times are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer. Figure 119 Example - Assign to Hold Folder report (Discovery Manager) Figure 120 Example - Assign to Hold Folder report (Discovery Manager) - details 198 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

199 Running EMC Discovery Manager Reports For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report The first row shows totals for some columns. Table 57 Body of Assign to Hold Folder report (Discovery Manager) Column Date User Matter Hold Folder Assigned Failed Description The date on which the assign to hold folder operation was performed. The name of the Discovery Manager user who performed the assign to hold folder operation. The name of the matter associated with the assign to hold folder operation. The name of the hold folder associated with the matter. The assigned items were copied to this hold folder. The total number of items that were assigned to the hold folder. The number of assigned items that failed to copy to the hold folder. Assign Operation Details To see details for an assign to hold folder (copy) operation, expand the row by clicking the plus sign (+) next to the date. Table 58 Assign Operation Details in Assign to Hold Folder report (Discovery Manager) Column Date User Description The date on which the assign to hold folder operation was performed. The name of the Discovery Manager user who performed the assign to hold folder operation. Note: This name is the Windows SID of the user. Matter Hold Folder Assigned Items Failed Items Operation ID The name of the matter. The name of the hold folder associated with the matter. The assigned items were copied to this hold folder. The total number of items that were assigned to the hold folder. The number of assigned items that failed to copy to the hold folder. The internal ID of the assign to hold folder operation. Assign to Hold Folder report (Discovery Manager) 199

200 Running EMC Discovery Manager Reports Matter Details To see matter details for an assign to hold folder operation: 1. In the report parameters, select Matter Details: True. 2. Expand the row by clicking the plus sign (+) next to the date. Refer to Table 55 on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

201 Running EMC Discovery Manager Reports Delete from Hold Folder report (Discovery Manager) The EMC Discovery Manager > Search Audit Reports > Delete from Hold Folder report lists the delete operations that were performed in matters associated with a hold folder. These operations include: User deletion of selected items that were assigned to a matter, performed in the Matter Review area Deletion of all items from a matter s hold folder when a user deletes the matter Note: Hold folders are available in the full edition of Discovery Manager. Prerequisite: Delete from Hold Folder report (Discovery Manager) Delete from hold folder operations are always audited. No auditing configuration is required. Considerations: Delete from Hold Folder report (Discovery Manager) Refer to Considerations for Discovery Manager reports on page 24. Procedure: Delete from Hold Folder report (Discovery Manager) To run the Delete from Hold Folder report for Discovery Manager: 1. Access the Assign to Hold Folder report (Home > EMC Discovery Manager > Search Audit Reports > Assign to Hold Folder Report), as described in Accessing Discovery Manager reports on page Enter report parameters, as described in Specifying parameters for Delete from Hold Folder report (Discovery Manager) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Delete from Hold Folder report (Discovery Manager) on page 204. Delete from Hold Folder report (Discovery Manager) 201

202 Running EMC Discovery Manager Reports Specifying parameters for Delete from Hold Folder report (Discovery Manager) Specify parameters for the Discovery Manager > Search Audit Reports > Delete from Hold Folder report as described in Table 59 on page 203. Figure 121 Example - default parameters for Delete from Hold Folder report (Discovery Manager) To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. 202 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

203 Running EMC Discovery Manager Reports Table 59 Delete from Hold Folder (Discovery Manager) report parameters Parameter Begin Date End Date Period User Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. To specify a period of time, select an option in the Period field: Today Yesterday Last 24 Hours This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year All Dates Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. The User field lists the names of all Discovery Manager users. To specify the user, select an option in the User field: All (default) The name of a Discovery Manager user Delete from Hold Folder report (Discovery Manager) 203

204 Running EMC Discovery Manager Reports Table 59 Delete from Hold Folder (Discovery Manager) report parameters Parameter Matter Description The list of matters depends on what you selected in the User field: If you selected All in the User field, then the Matter field lists the names of all matters that have ever had an assign to hold folder operation performed in Discovery Manager. If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had an assign to hold folder operation performed by the selected user in Discovery Manager. Note: If a matter was renamed, and if delete from hold folder operations were performed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all delete from hold folder operations associated with a specific matter ID will be displayed in report results. To specify the matter, select an option in the Matter field: All (default) The name of a Discovery Manager matter Matter Details Expand All Groups Select one of the Matter Details options: True (default) - Displays the Matter Details section when you expand a row in the report. False - Does not display the Matter Details section when you expand a row in the report. Select one of the Expand All Groups options: True - Expands all rows and sections to display details. False (default) - Does not expand all rows and sections. Understanding the Delete from Hold Folder report (Discovery Manager) This section describes the information displayed in the Delete from Hold Folder report for Discovery Manager. Times are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer. 204 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

205 Running EMC Discovery Manager Reports Figure 122 Example - Delete from Hold Folder report (Discovery Manager) Figure 123 Example - Delete from Hold Folder report (Discovery Manager) - details For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report The first row shows totals for some columns. Table 60 Body of Delete from Hold Folder report (Discovery Manager) Column Date User Matter Description The date on which the delete from hold folder operation was performed. The name of the Discovery Manager user who performed the delete from hold folder operation. The name of the matter associated with the delete from hold folder operation. Delete from Hold Folder report (Discovery Manager) 205

206 Running EMC Discovery Manager Reports Table 60 Body of Delete from Hold Folder report (Discovery Manager) Column Hold Folder Deleted Failed Description The name of the hold folder associated with the matter. The assigned items were deleted from this hold folder. The number of items that were deleted successfully from the hold folder. The number of items that failed to delete from the hold folder. Delete Operation Details To see details for delete from hold folder operation, expand the row by clicking the plus sign (+) next to the date. Table 61 Delete Operation Details in Delete from Hold Folder report (Discovery Manager) Column Date User Description The date on which the delete from hold folder operation was performed. The name of the Discovery Manager user who performed the delete from hold folder operation. Note: This name is the Windows SID of the user. Matter Hold Folder Deleted Items Failed Items Operation ID The name of the matter. The name of the hold folder associated with the matter. The items were deleted from this hold folder. The number of items that were deleted successfully from the hold folder. The number of items that failed to delete from the hold folder. The internal ID of the delete from hold folder operation. Matter Details To see matter details for a delete from hold folder operation: 1. In the report parameters, select Matter Details: True. 2. Expand the row by clicking the plus sign (+) next to the date. Refer to Table 55 on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

207 Running EMC Discovery Manager Reports Documents Viewed report (Discovery Manager) The Discovery Manager Documents Viewed report lists the documents in collection searches that were viewed by users in the Discovery Manager client application. Note: There will be multiple audits if a user views the same document in the same matter. Prerequisite: Documents Viewed report (Discovery Manager) Collection searches and documents viewed are always audited. No auditing configuration is required. Procedure: Documents Viewed report (Discovery Manager) To run the Documents Viewed report for Discovery Manager: 1. Access the Search Activity report (Home > EMC Discovery Manager > Search Audit Reports > Documents Viewed Report), as described in Accessing Discovery Manager reports on page Enter report parameters, as described in Specifying parameters for Documents Viewed report (Discovery Manager) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Documents Viewed report (Discovery Manager) on page 210. Specifying parameters for Documents Viewed report (Discovery Manager) Specify parameters for the Discovery Manager > Search Audit Reports > Documents Viewed report as described in Table 62 on page 208. Documents Viewed report (Discovery Manager) 207

208 Running EMC Discovery Manager Reports Figure 124 Example - default parameters for Documents Viewed (Discovery Manager) report To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. Table 62 Documents Viewed (Discovery Manager) report parameters Parameter Begin Date End Date Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. 208 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

209 Running EMC Discovery Manager Reports Table 62 Documents Viewed (Discovery Manager) report parameters Parameter Period User Matter Description To specify a period of time, select an option in the Period field: Today Yesterday Last 24 Hours This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year All Dates Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. The User field lists the names of all Discovery Manager users. To specify the search user, select an option in the User field: All (default) The name of a Discovery Manager user The list of matters depends on what you selected in the User field: If you selected All in the User field, then the Matter field lists the names of all matters that have ever had documents viewed in Discovery Manager. If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had documents viewed by the selected user in Discovery Manager. Note: If a matter was renamed, and if document views or previews were performed in the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all searches associated with a specific matter ID will be displayed in report results. To specify the matter, select an option in the Matter field: All (default) The name of a Discovery Manager matter Matter Details Expand All Groups Select one of the Matter Details options: True (default) - Displays the Matter Details section when you expand a row in the report. Refer to Matter Details on page 194 for a description. False - Does not display the Matter Details section when you expand a row in the report. Select one of the Expand All Groups options: True - Expands all rows and sections to display details. False (default) - Does not expand all rows and sections. Documents Viewed report (Discovery Manager) 209

210 Running EMC Discovery Manager Reports Understanding the Documents Viewed report (Discovery Manager) This section describes the information displayed in the Documents Viewed report for Discovery Manager. Times are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer. Figure 125 Example - Documents Viewed report (Discovery Manager) Figure 126 Example - Documents Viewed report (Discovery Manager) - details 210 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

211 Running EMC Discovery Manager Reports For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report The first row shows totals for some columns. Table 63 Body of Documents Viewed report (Discovery Manager) Column Date Viewed User Document ID Document Date Title Description The date on which the document was viewed. The name of the Discovery Manager user who viewed the document. The internal ID of the document. The most significant date for the document s content type. The subject of an item or SharePoint item, or the name of a file.. View Details To see details for a view operation, expand the row by clicking the plus sign (+) next to the date. Table 64 Search Operation Details in Documents Viewed report (Discovery Manager) Column Date Viewed User Description The date on which the document was viewed. The name of the Discovery Manager user who viewed the document. Note: This name is the Windows SID of the user. Viewed From The area in Discovery Manager from which the user viewed the document: Collection.Area or Matter Review. Documents Viewed report (Discovery Manager) 211

212 Running EMC Discovery Manager Reports Associated Search Details To see details for the search associated with a view operation, expand the row by clicking the plus sign (+) next to the date. Note: This section is included for view operations performed in the Collection Area in the Discovery Manager client application. It is not included for view operations performed in the Matter Review Area. Table 65 Associated Search Details in Documents Viewed report (Discovery Manager) Column Search Name Search Terms Search Folders Search Type Description The name of the collection search associated with the viewed document. The search criteria. If the user did not specify criteria, then the Search Terms column displays Date <= The names of the SourceOne mapped folders that were searched. In this release, the Search Type is always Collection. Matter Details To see matter details for a view operation: 1. In the report parameters, select Matter Details: True. 2. Expand the row by clicking the plus sign (+) next to the date. Table 66 Matter Details (Discovery Manager) Column Name Matter ID Description The name of the matter associated with the operation. The internal ID of the matter. 212 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

213 Running EMC Discovery Manager Reports Document Details To see details for a view operation, expand the row by clicking the plus sign (+) next to the date. Table 67 Document Details in Documents Viewed report (Discovery Manager) Column Document ID Document Date Title Document Type Size Has Attachments Encrypted Sender Recipients (partial) Description The internal ID of the document. The most significant date for the document s content type. The title or subject of the document. The content type of the document. The size of the document. Indicates whether or not the document has attachments: True = has attachments False = does not have attachments Indicates whether or not the document is encrypted: True = is encrypted False = is not encrypted For content types, the display name of the sender. For content types, the display name of the recipients. This is a partial list of recipients. Documents Viewed report (Discovery Manager) 213

214 Running EMC Discovery Manager Reports Export Activity report (Discovery Manager) The Discovery Manager Export Activity report lists the export operations that were performed by users in the Discovery Manager client application. Prerequisite: Export Activity report (Discovery Manager) Exports are always audited. No auditing configuration is required. Procedure: Export Activity report (Discovery Manager) To run the Export Activity report for Discovery Manager: 1. Access the Search Activity report (Home > EMC Discovery Manager > Search Audit Reports > Export Activity Report), as described in Accessing Discovery Manager reports on page Enter report parameters, as described in Specifying parameters for Export Activity report (Discovery Manager) on page Click View Report to generate the report based on your parameters. 4. To interpret the report, refer to Understanding the Export Activity report (Discovery Manager) on page 216. Specifying parameters for Export Activity report (Discovery Manager) Specify parameters for the Discovery Manager > Search Audit Reports > Export Activity report as described in Table 68 on page 215. Figure 127 Example - Default parameters for Export Activity report (Discovery Manager) To specify a date, do one of the following steps: Use the Begin Date field or the End Date field to specify an open-ended date range. 214 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

215 Running EMC Discovery Manager Reports Use the Begin Date field and the End Date field to specify a bounded date range. Use the Period field to specify a span of time. Table 68 Export Activity (Discovery Manager) report parameters Parameter Begin Date End Date Period User Description Do one of the following steps: If you do not want to specify a Begin Date, select the NULL checkbox (default). To specify a Begin Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. Do one of the following steps: If you do not want to specify an End Date, select the NULL checkbox (default). To specify an End Date, clear the NULL checkbox, click the calendar icon, then select a date. The Period field defaults to Not Specified. To specify a period of time, select an option in the Period field: Today Yesterday Last 24 Hours This Week Last Week This Month Last Month This Quarter Last Quarter This Year Last Year All Dates Not Specified - Do not select this option; it will not return any results. It is displayed automatically if you specify a Begin Date or an End Date. The User field lists the names of all Discovery Manager users. To specify the search user, select an option in the User field: All (default) The name of a Discovery Manager user Export Activity report (Discovery Manager) 215

216 Running EMC Discovery Manager Reports Table 68 Export Activity (Discovery Manager) report parameters (continued) Parameter Matter Description The list of matters depends on what you selected in the User field: If you selected All in the User field, then the Matter field lists the names of all matters that have ever had documents viewed in Discovery Manager. If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had documents viewed by the selected user in Discovery Manager. Note: If a matter was renamed, and if searches were executed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all searches associated with a specific matter ID will be displayed in report results. To specify the matter, select an option in the Matter field: All (default) The name of a Discovery Manager matter Matter Details Expand All Groups Select one of the Matter Details options: True (default) - Displays the Matter Details section when you expand a row in the report. Refer to Matter Details on page 194 for a description. False - Does not display the Matter Details section when you expand a row in the report. Select one of the Expand All Groups options: True - Expands all rows and sections to display details. False (default) - Does not expand all rows and sections. Understanding the Export Activity report (Discovery Manager) This section describes the information displayed in the Export Activity report for Discovery Manager. Times are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer. Figure 128 Example - Export Activity report (Discovery Manager) 216 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

217 Running EMC Discovery Manager Reports Figure 129 Example - Export Activity report (Discovery Manager) - details For information about the Report Configuration section, refer to Display features in EMC SourceOne and Discovery Manager reports on page 26. Body of report Each row shows information for one export operation. Table 69 Body of Export Activity report (Discovery Manager) Column Date User Export ID Description The date on which the export was created. The name of the Discovery Manager user who created the export. The internal ID of the export. Export Activity report (Discovery Manager) 217

218 Running EMC Discovery Manager Reports Table 69 Body of Export Activity report (Discovery Manager) Column Exported Failed Output Files Output Size Processing Time Status Description The number of items that exported successfully.. The number of items that failed to export.. The total number number of container files and metadata files produced in this export. The total size of container files and metadata files produced in this export. The duration of the export job. Status of the export operation: Green check = All items exported successfully Exclamation mark = Some items failed to export. Red X = All items failed to export. Export Configuration To see configuration information for an export operation, expand the row by clicking the plus sign (+) next to the date. The Export Configuration section shows the options that were selected in the Export dialog box when the export was created. Table 70 Export Configuration - Export Activity report (Discovery Manager) Field Date User Export ID Export Name Container Type Metadata Type Separate by Custodian Description The date on which the export was created. The name of the Discovery Manager user who created the export. The internal ID of the export. The name of the export.specified in the Export dialog. The container type (None, Native, NSF, PST, or File System) that was selected in the Export dialog. The metadata type (None, CSV, TSV, or EDRM) that was selected in the Export dialog. Indicates whether the Split By Custodian option was selected in the Export dialog: True = The Split By Custodian option was selected. False = The Split By Custodians option was not selected. 218 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

219 Running EMC Discovery Manager Reports Table 70 Export Configuration - Export Activity report (Discovery Manager) Field Maximum File Size Export Data Location Enhanced Xtender Duplicate Tracking Description The value specified in the Split By File Size field in the Export dialog. The location specified in the File Location field in the Export dialog. In Discovery Manager Configuration settings, the Discovery Manager Application Administrator specifies whether or not Xtender duplicate messages are tracked. Refer to "Configuring Discovery Manager" in the EMC SourceOne Discovery Manager User Guide. Values: True = Xtender duplicate messages are tracked in the Discovery Manager client and can be displayed. False = Xtender duplicate messages are not tracked in the Discovery Manager client. Export Results To see information about the export results for an export operation, expand the row by clicking the plus sign (+) next to the date. Table 71 Export Results - Export Activity report (Discovery Manager) Field Submitted Expected Exported Failed Output Files Total Size Maximum File Size Export Data Location Errors Description The number of items selected for export. The number of items that Discovery Manager calculated to be exported, based on options selected in the Export dialog. For example, assume 100 items were selected (submitted) for export and the Split By Custodian option was enabled. If 75 messages were tagged with CustodianA and 40 messages were tagged with CustodianB, then the Expected count would be 115 ( ). The number of items that exported successfully. The number of items that failed to export. The total number number of container files and metadata files produced in this export. The total size of container files and metadata files produced in this export. The value specified in the Split By File Size field in the Export dialog. The location specified in the File Location field in the Export dialog. If errors occurred, then this field lists the error messages. If no errors occurred, then this field is blank. Export Activity report (Discovery Manager) 219

220 Running EMC Discovery Manager Reports Containers To see details about the container files and metadata files produced by an export operation, expand the row by clicking the plus sign (+) next to the date, then click the plus sign (+) next to the Containers section. Table 72 Containers - Export Activity report (Discovery Manager) Field Name Description Lists the name of each container file and metadata file produced by the export. For information about how output files are named, refer to the EMC SourceOne Discovery Manager User Guide. Custodians The Custodians section is available if you selected the Split by custodian option in the Export dialog. To see details about the custodians associated with an export operation, expand the row by clicking the plus sign (+) next to the date, then click the plus sign (+) next to the Custodians section. Table 73 Custodians - Export Activity report (Discovery Manager) Field Custodian Container Description The name of the custodian. The names of the container files and metadata files produced for the custodian. Matter Details To see the properties of the matter associated with an export operation: 1. In the report parameters, select Matter Details: True. 2. Expand the row by clicking the plus sign (+) next to the date. Refer to Table 55 on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

221 8 Customizing Reports This chapter explains how to customize the reports supplied with EMC SourceOne, and is organized as follows: Changing parameter defaults Adding a company logo Customizing Reports 221

222 Customizing Reports Changing parameter defaults To customize parameter labels for a report, modify the parameter properties.! IMPORTANT Modify only the parameters that are documented in this chapter. Modifying unsupported parameters may result in incorrect reports, or may require reinstalling the reports. Parameters may change in future releases, so backward compatibility is not guaranteed. Required permissions To change parameter defaults, you must have one of the following roles in SQL Server Reporting Services: System Administrator role Content Manager role Accessing the parameter properties for a report Navigation to the report properties differs depending on the version of SQL Server (2008 or 2008 R2). Note: The following examples show how to navigate to the EMC SourceOne Search Activity report properties in both SQL Server 2008 and SQL Server 2008 R2. To access the parameter properties for a report: 1. Do one of the following steps: For SQL Server 2008: a. Navigate to the specific report (for example, EMC SourceOne > Search Audit Reports > Search Activity Report). b. Click the Properties tab. 222 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

223 Customizing Reports Figure 130 In SQL Server 2008, click the report s Properties tab For SQL Server 2008 R2: a. Navigate to the folder containing the report (for example, EMC SourceOne > Search Audit Reports). b. Select Manage in the report s dropdown menu. Figure 131 In SQL Server 2008 R2, select Manage in the report s dropdown menu 2. On the left side of the report s Properties page, select Parameters. Changing parameter defaults 223

224 Customizing Reports Figure 132 Parameter properties - Search Activity report - SQL Server 2008 Figure 133 Parameter properties - Search Activity report - SQL Server 2008 R2 3. Continue to the appropriate section: Changing the Expand All Groups default on page 225 Changing the maximum row count on page 225 Modifying the footer text on page EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

225 Customizing Reports Changing the Detailed default on page 226 Changing the Activity Type default on page To save your changes to the Parameters property page, click Apply. Changing the Expand All Groups default You can change the Expand All Groups default for individual Search Audit reports. By default, the Expand All Groups parameter is set to False. When set to True, this parameter expands all rows and sections in the report to display details. To change the Expand All Groups default: 1. Access the parameters of the Search Audit report you want to modify, as described in Accessing the parameter properties for a report on page On the Parameters page, change the Default Value of the ExpandGroups parameter to True. 3. Click Apply. Changing the maximum row count You can change the MaxRowCount default for individual Search Audit reports, for individual Configuration reports, and for the Data Source processing report. By default, the MaxRowCount parameter is not visible for users to modify on the report s parameter panel. The current MaxRowCount default is shown in the Report Configuration section of the report. By default, MaxRowCount set to To change the MaxRowCount default: 1. Access the parameters of the report you want to modify, as described in Accessing the parameter properties for a report on page On the Parameters page, change the Default Value of the MaxRowCount parameter to the value you want. 3. Click Apply. Changing parameter defaults 225

226 Customizing Reports Modifying the footer text You can change the footer text for individual reports of any type. By default, the footer text is set to Company Confidential - For internal use only. To change the footer text: 1. Access the parameters of the report you want to modify, as described in Accessing the parameter properties for a report on page On the Parameters page, change the Default Value of the FooterText parameter to the text you want. 3. Click Apply. Changing the Detailed default You can change the Detailed default for the Data Source Processing report. By default, the Detailed parameter is set to False. When set to True, this parameter generates a Process Details section for the specified activity, and enables drill through to the Process Details section. To change the Detailed default: 1. Access the parameters of the Data Source Processing report, as described in Accessing the parameter properties for a report on page On the Parameters page, change the Default Value of the Detailed parameter to True. 3. Click Apply. Changing the Activity Type default You can change the Activity Type default for the Data Source Processing report. By default, the Activity Type parameter is set to Journal. To change the Activity Type default: 226 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide

227 Customizing Reports 1. Access the parameters of the Data Source Processing report, as described in Accessing the parameter properties for a report on page On the Parameters page, change the Default Value of the ActivityType parameter to the activity of your choice. 3. Click Apply. Adding a company logo You can add a company logo that will appear in the upper right corner of every report. The dimensions of the logo area are: Width: 1.00 inch Height: 0.75 inch Figure 134 Example - Custom logo Required permissions To add a company logo, you must have one of the following roles in SQL Server Reporting Services: System Administrator role Content Manager role Procedure: Adding a company logo To add a company logo to all EMC SourceOne reports or to all Discovery Manager reports: Adding a company logo 227

228 Customizing Reports 1. On the SQL Server Reporting Services home page, do one of the following steps, depending on which group of reports you want to customize: Open the EMC SourceOne folder. Open the Discovery Manager folder. Note: The examples in this procedure show the EMC SourceOne folder. The steps are the same for the Discovery Manager folder. 2. Click Details View on the toolbar. Figure 135 EMC SourceOne folder - default Tile View The Details View displays. Figure 136 EMC SourceOne folder - Details View 3. Open the Images folder. 228 EMC SourceOne Auditing and Reporting Version 7.0 Installation and Administration Guide