-1

Unknown. An unknown audit event occurred.

0

Event Viewed. The 'AuditDetail' column is empty for automatically audited events. The 'AuditDetail' column may also contain a string representation of the duration (in seconds) that an event was viewed in the iConsole Quick View pane.

1

Field 1 Changed. The audit field 1 value for an issue was changed by an auditor. The 'AuditDetail' column defines the new field 1 index value (which can be used as an index into the WgnWellKnownString table for WKType 2 entries, or may be -1 to indicate "unset").

2

Comment. An auditor added a comment. The 'AuditDetail' column contains the actual comment.

3

Expiry. The expiry date for an event was changed. The 'AuditDetail' column contains the new expiry date (decimal representation of a WGNTIMESTAMP).

4

Permanent. The 'Do not delete' setting for an event was changed. The 'AuditDetail' column contains the new setting (0 or 1).

5

Mailed Event. An audit notification mail was sent for an event/issue. The 'AuditDetail' column contains the summary details of the mail that was sent.

6

Field 2 Changed. The audit field 2 value for an issue was changed by an auditor. The 'AuditDetail' column defines the new field 2 index value (which can be used as an index into the WgnWellKnownString table for WKType 5 entries, or may be -1 to indicate "unset").

7

Field 3 Changed. The audit field 3 value for an issue was changed by an auditor. The 'AuditDetail' column defines the new field 2 index value (which can be used as an index into the WgnWellKnownString table for WKType 6 entries, or may be -1 to indicate "unset"). Note that for audit field 3 only, the auditdetail column may also contain one or more values, enclosed in square brackets, such as, [0][3][7].

8

Quarantine. The quarantine state for an event was changed. The 'AuditDetail' column contains one of the following values:

1 = Released from quarantine

2 = Rejected from quarantine

3 = Successfully sent by quarantine manager service after release from quarantine.

4 = Failed to be sent by quarantine manager service after release from quarantine (awaiting retry).

5 = Failed to be sent by quarantine manager service after release from quarantine (blocked).

9

Issue Participant. The (single) associated participant for an audit issue was changed. The 'AuditDetail' column contains the participant index (or -1 for "all participants"). This audit type has been superseded by types 14 and 15 as we now support multiple participants per issue, but will still exist in pre 4.7 DB versions.

10

Issue Name. The name of an audit issue was changed. The 'AuditDetail' column contains the new issue name.

11

Issue Created. An audit issue was created for an event. The 'AuditDetail' column contains the issue name.

12

Event Exported. The event was exported from the Data Management Console. The 'AuditDetail' column contains the export format ("Event File", "Microsoft Outlook Message", "Microsoft Personal Folder" or "Virtual Web Site").

13

Event Printed. The 'AuditDetail' column is empty for these events.

14

Issue Participant Added. A participant was added to the list of participants associated with an audit issue. The 'AuditDetail' column contains the participant index. This type has been added to support multiple participants per issue.

15

Issue Participant Removed. A participant was removed from the list of participants associated with an audit issue. The 'AuditDetail' column contains the participant index. This type has been added to support multiple participants per issue.