Audit log views
The listing and the message flow diagram, and how to read each of them.
The audit log has two main screens - the listing and the message flow.
The listing
Monitoring -> Audit log in Dashboard, or the Audit log link on any channel's or connection's own row, which opens it filtered to that one object.
The listing is the main screen: a list of events on the left, the selected event's detail on the right, and the source and object filters at the top.
Filtering:
- Source and object. Two pickers, and each can select things either in or out. Picking out is how you say "everything except", for instance every source except log access when configuration changes are drowning out the traffic.
- Search. Free text across the payload, the event type, the message ID, the correlation ID, the endpoint, the status, the classification, the external client ID and the subscription key. For sources that have identifiers of their own - a patient identifier on an HL7 message, for example - searching for one returns the whole exchange it appears in, not just the single event that mentions it.
- Outcome. Only the outcomes the current source can actually report, so pub/sub offers
expiredand the scheduler offersrunningandtimeout. - Event type. Click an event type on any row to filter down to it.
- Time range. From the last five minutes to everything, and the page can refresh itself while you watch.
- Outstanding. For the sources that pair a message with an acknowledgement, this shows the exchanges whose acknowledgment has not arrived, oldest first.
Each event shows its correlation ID, status, classification, endpoint, duration and size. Values link to where they lead - a channel's endpoint to the service, an object to its own configuration page, a scheduler run to that run's detail.
The activity strip
The band above the list turns whatever the filters currently match into a histogram of counts over time, coloured by outcome. A burst of errors is visible without scrolling through the rows, and clicking a bar narrows the list to that slice of time.
Message bodies
Opening an event's payload gives you two tabs, Raw and Parsed. Parsed is where a structured message becomes readable - an HL7 message as a tree, a scheduler run as its job, outcome, duration and captured log lines.
Log access source, as who opened which message and from which screen.Attachments
Where a message arrived with files - an email's attachments, a transferred file - they appear as a strip of badges below the detail, each with its filename and size. Clicking one downloads it under its original name and content type.
Very large files keep their metadata but not their bytes, and say not kept rather than offering a download. Attachments are deleted along with the events that contain them.
Message flow
Reached from an event's detail pane through Open flow.
The listing shows what happened to one object. The flow shows what happened to one message, across every object it touched. A message that arrived on a channel, was sent to several destinations, had one of them fail and get resubmitted is one flow with all of those events in it, drawn as a diagram you can pan, zoom and replay in order. Related events are brought in whether they share the correlation ID, the message ID, or a resubmission link, and each line says which.
Clicking a node opens its detail card - the events of that exchange, each with its role, outcome and timing, and the payload one more click away.
Finding a flow from an identifier
The search box at the top of the flow page takes a control ID, a correlation ID or an event ID, and works out for itself which one you gave it. Paste in a reference somebody quotes at you and you get the whole exchange, without knowing which connection to look under first.