Configure audit settings

You can enable or disable auditing of administrator or security events in

BlackBerry UEM

. When auditing is enabled, you can choose how long you want to keep records, the number of results to display, and when to delete old records. When auditing is disabled, all records are deleted.

This feature is not supported for

BlackBerry UEM Cloud

Enabling security event auditing requires significant database resources. Use the UEM performance calculator to estimate the resources required.

On the menu bar, click

Settings

Infrastructure

Audit configuration

In the right pane, click The Edit icon

In the

Administrator event audit settings

section, do one of the following:

Task	Steps
Enable administrator event auditing	In the Administrator event auditing field, click Enabled . In the Administrator audit record retention field, type the maximum number of days to keep a record. In the Maximum number of records field, type the maximum number of records to display in the UI. If the number of records exceeds this value, then the administrator must shorten the date range or select a category to reduce the number of records. In the Daily delete time (UTC) field, choose the time of day to delete records.
Disable administrator event auditing and purge all records	In the Administrator event auditing field, click Disabled .

Task

Steps

Enable administrator event auditing

In the

Administrator event auditing

field, click

Enabled

In the

Administrator audit record retention

field, type the maximum number of days to keep a record.

In the

Maximum number of records

field, type the maximum number of records to display in the UI. If the number of records exceeds this value, then the administrator must shorten the date range or select a category to reduce the number of records.

In the

Daily delete time (UTC)

field, choose the time of day to delete records.

Disable administrator event auditing and purge all records

In the

Administrator event auditing

field, click

Disabled

In the

Security event audit settings

section, do one of the following:

Task	Steps
Enable security event auditing	In the Security event auditing field, click Enabled . In the Security audit record retention field, type the maximum number of days to keep a record. In the Daily delete time (UTC) field, choose the time of day to delete old records. To stop auditing a security event, click beside the event type. To add security events to audit, click . Select the events and click Add . Optionally, if a drop-down list is available in the Setting column beside an event type, choose the condition to log the event.
Disable security event auditing and purge all records	In the Security event auditing field, click Disabled .

Task

Steps

Enable security event auditing

In the

Security event auditing

field, click

Enabled

In the

Security audit record retention

field, type the maximum number of days to keep a record.

In the

Daily delete time (UTC)

field, choose the time of day to delete old records.

To stop auditing a security event, click The Remove icon

beside the event type.

To add security events to audit, click The Add icon

. Select the events and click

Add

Optionally, if a drop-down list is available in the

Setting

column beside an event type, choose the condition to log the event.

Disable security event auditing and purge all records

In the

Security event auditing

field, click

Disabled

Click

Save

Restart the

BlackBerry UEM Core

service on every computer that hosts a

BlackBerry UEM

instance.

Section:

Auditing events in BlackBerry UEM