Auditing who accessed ESA Logs

[John71357]

Hi All, Is there any access auditing on the ESA?  For example, can a log be kept on who accessed the DLP matched content log? 

[Udupi Krishna.]

You can try logging into the CLI of the ESA and execute tail audit_logs or grep a specific timeline for information.

Assuming you would like to look at logs from Nov 30, this command would throw out all logs generated on that specific day - grep "Nov 30" audit_logs

Now its not likely to showcase the information you are looking but its worth a shot