Create audit archives for offline PI Audit database files

When PI AuditViewer starts for the first time, only online Audit Database files are available. To search and view historical data in offline audit files, you must organize these individual audit files into Audit Archives.

We recommend these best practices for creating audit archives:

• Ensure that each audit archive contains one audit database file for each of the three Data Archive subsystems that record audit records: Base, Archive and Snapshot. If a file is omitted, a search might retrieve incomplete results.

• If you currently have offline audit files that do not cover the same time period, you can specify the same file within multiple audit archives.

To create audit archive files:

1. Click File > Manage. Alternatively, open the Manage panel on the ShortCuts pane, and then click the Manage link.

   You see the PI Audit Management pane.

2. Click on the toolbar above the Audit Archives tree.

   A new Audit Archive is created and you see the Subsystem Details view.

3. In the Base Subsystem group on the Details tab, click , navigate to the Base Subsystem audit file (pibasessAudit.dat) you want to include, click the file name to select it, and then click Open.

   You see the file path in the Source File box.

4. Click the Scan File button to retrieve information about the audit file. Verify that the information on the file is correct.

5. Repeat steps 3 and 4 to add the audit file for the Archive Subsystem (piarchssAudit.dat).

6. Repeat steps 3 and 4 to add the audit file for the Snapshot Subsystem (pisnapssAudit.dat).

7. (Optional) To rename an Audit Archive, right-click the name in the tree and select Rename.

8. (Optional) To change the order of Audit Archives, click the Audit Archive in the tree, and then use and to move the Audit Archive to the desired position.

Timing considerations

You can create a better search experience if you consider the timing implications of how audit archives are created and labeled.

• The date and time included in the name of an audit file indicate the time that the audit file shifted. This means that you can expect that the Action Times for audit records in the file are before the date and time in the file name.

• The Creation Date of the audit file indicates the date and time that the audit file was created. You can expect that the Action Times for audit records in the file are after the Creation Date. You can use the Creation Date and date and time in the file name to determine the date and time range of Action Times you can expect for audit records in the file.

• Depending on when the audit files for each subsystem shifted, the date range of Action Times for audit records in the audit record files for each of the subsystems may not be exactly the same.

  If the date range that you are looking to search spans multiple audit files for the same subsystem, you can create audit Archives in PI AuditViewer for each audit file and specify the same audit files again for the other subsystems to cover the full range. Then perform your search across all of the relevant audit Archives.