> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/management/system-events.md).

# System Events

The system event overview allows you to centrally view security-relevant events collected from the event logs of your hosts. These events are recorded by the Pulsar installed on each host.

***

## Requirements

**Enabling System Event Monitoring**

For Enginsight to be able to monitor and show system events of your hosts, the following requirements must be met:

* The logging of system events must be enabled either in the [settings of individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md) or under **Hosts** → **Policy Manager** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md).
* System event logging must be enabled on the operating system of the monitored host. On Linux systems, events from the **auditd** service can also be collected.

{% hint style="success" icon="lightbulb" %}
For more information on which system events are monitored by Enginsight, see our Knowledge Base: [Which system events are logged by Enginsight on monitored hosts?](https://docs.enginsight.com/docs/knowledge-base/english/logging/which-system-events-are-logged-by-enginsight-on-monitored-hosts) 
{% endhint %}

**Object Access on Windows Hosts**

* To show access to files and directories on Windows hosts in the system events, this option must be explicitly enabled on the respective host.

{% hint style="success" icon="lightbulb" %}
For more information on how to enable object access on Windows hosts, see our Knowledge Base: [How can I monitor object access on Windows systems with Enginsight in the system events?](https://docs.enginsight.com/docs/knowledge-base/english/file-integrity-monitoring-fim/how-can-i-monitor-object-access-on-windows-systems-with-enginsight-in-the-system-events)
{% endhint %}

## Important Notes

**Retention Period of System Events**

* System events are stored for 14 days by default in Enginsight SaaS instances, and this retention period cannot be changed.
* For on-premises installations, the default retention period is 3 days. You can adjust this period via the Enginsight configuration file.

{% hint style="success" icon="lightbulb" %}
For more information on how to adjust the retention period of Enginsight logs, see our Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)
{% endhint %}

***

<i class="fa-compass">:compass:</i> Navigate to **Hosts** → **System Events** to show a timeline and a list of all logged system events. If no system events have been recorded yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FkmOwB4ka6uQQF49ZlRds%2Fenginsight-screenshot-hosts-management-systemevents.jpg?alt=media&amp;token=032c97e3-b89e-4cae-88ba-f49a57632b44" alt=""><figcaption></figcaption></figure>

The [system events overview](#system-events-overview) provides information such as:

* which system event occurred and whether it was successful or failed.
* on which host the event occurred and which user and IP address were involved.
* exactly when the event occurred.

You can also define a [start and end time](#define-start-and-end-time) for the analysis period and [export the list](#export-the-list).

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Defining Start and End Time

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-calendar-days">:calendar-days:</i> **Start Time** or <i class="fa-calendar-days">:calendar-days:</i> **End Time** in the upper-right corner to define the start or end of the period to be analyzed. The date picker opens.

{% tabs %}
{% tab title="Relative Time Period" %}
Define a **Relative Time Period** manually. You can also select a relative time range from one of the available **Templates**.

<div align="left"><figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FrrYJOLp7HuEQorpFUCX2%2FEnginsight-EN-Date%20Picker-Relative%20Time%20Period.jpg?alt=media&amp;token=1018f4bd-8137-4bba-a2c8-8fd8202538a4" alt="" width="235"><figcaption></figcaption></figure></div>

<i class="fa-computer-mouse">:computer-mouse:</i> Click the field with the default setting **Days Ago** to expand a list of all available time ranges. Select a time range.

In the number field, enter the number of seconds, minutes, hours, days, or weeks you want to show. The default value is **1**.

<i class="fa-computer-mouse">:computer-mouse:</i> Click **Apply** to confirm your settings.
{% endtab %}

{% tab title="Absolute Time Period" %}
Select a date from the calendar view.

<div align="left"><figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2Fp2GTtoSJ59r7MIYreBFZ%2FEnginsight-EN-Date%20Picker-Absolute%20Time%20Period.jpg?alt=media&amp;token=e00bb0e2-c7ed-4ddb-9629-e02b34df20e6" alt="" width="232"><figcaption></figcaption></figure></div>

<i class="fa-computer-mouse">:computer-mouse:</i> Optionally, click <i class="fa-clock">:clock:</i> **Time** to set an exact time in the 24-hour format using the clock face. First, select an hour. The clock face then switches to the minute view. Select the required minutes.

<i class="fa-computer-mouse">:computer-mouse:</i> Click **Apply** to confirm your settings.
{% endtab %}
{% endtabs %}

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-arrow-rotate-left">:arrow-rotate-left:</i> **Reset** in the upper-right corner to reset the settings for the selected time range.

### Filtering the List

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

<details>

<summary>Available Filters</summary>

<table><thead><tr><th width="206.60546875">Parameter</th><th width="116.515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>Application</td><td>String</td><td>Filter for a specific software application affected by the system event, or exclude it from the results. All available file paths containing affected software applications are shown.</td></tr><tr><td>Event Name</td><td>String</td><td>Filter for a specific system event, or exclude it from the results. All available system events are shown.</td></tr><tr><td>Host</td><td>String</td><td>Filter for a specific host name, or exclude it from the results. All available host names are shown.</td></tr><tr><td>Category</td><td>String</td><td>Filter for a specific system event category, or exclude it from the results. All available categories are shown.</td></tr><tr><td>Status</td><td>String</td><td>Filter based on whether a system event was successful or failed.</td></tr><tr><td>Subcategory</td><td>String</td><td>Filter for a specific system event subcategory, or exclude it from the results. All available subcategories are shown.</td></tr></tbody></table>

</details>

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

***

## System Events: Timeline

The system events timeline shows a bar chart that displays the total number of recorded system events during the selected time period.

{% hint style="info" %}
Each bar represents a time interval of 5 minutes.
{% endhint %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FZdx9hlz33e9Mmhr9P0kj%2Fenginsight-screenshot-hosts-management-systemevents-timeline.jpg?alt=media&amp;token=dd947624-06ae-4d56-8f83-4e80653f4615" alt=""><figcaption></figcaption></figure>

<i class="fa-computer-mouse">:computer-mouse:</i> Click **Success** or **Failure** to show or hide the corresponding categories of system events.

<i class="fa-arrow-pointer">:arrow-pointer:</i> Hover over a bar in the chart to show the aggregated number of categorized system events at the selected point in time.

***

## System Events: Overview

The system events overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FcnmJBC48cCum1qZYflVg%2Fenginsight-screenshot-hosts-management-systemevents-overview.jpg?alt=media&amp;token=fdc227a7-baea-4b7e-bb26-1fbfed5ac99e" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="200.14453125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Status</td><td><p>Shows the status of the respective system event.</p><p></p><p>The following statuses may be displayed:</p><ul><li><strong>Success</strong>: The action described by the system event was successful.</li><li><strong>Failure</strong>: The action described by the system event was unsuccessful.</li></ul></td></tr><tr><td>Name</td><td><p>Shows the name of the respective system event, along with additional information such as the user's IP address, the user name, and the source of the system event.</p><div data-gb-custom-block data-tag="hint" data-style="success" data-icon="lightbulb" class="hint hint-success"><p>For more information on which system events are monitored by Enginsight, see our Knowledge Base: <a href="https://docs.enginsight.com/docs/knowledge-base/english/logging/which-system-events-are-logged-by-enginsight-on-monitored-hosts">Which system events are logged by Enginsight on monitored hosts?</a></p></div></td></tr><tr><td>Category</td><td>Shows the type of system event and the exact reason why the event was successful or failed.</td></tr><tr><td>Details</td><td><p>Shows the category of the system event.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>This option is only available for Windows system events.</p></div></td></tr><tr><td>Host</td><td>Shows the name of the host on which the system event occurred.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a host to navigate to the respective <a href="/docs/manual/english/platform-usage/host-detail-view.md">host detail view</a>.</td></tr><tr><td>Observed at</td><td>Shows the date and time when the system event occurred.</td></tr><tr><td>Details</td><td><p>Provides more detailed information about a system event.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>This option is only available for Windows system events.</p></div><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Details</strong> to show the event log entry from which the system event originated.</p></td></tr></tbody></table>

***

## Exporting the List

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-down-to-line">:down-to-line:</i> **Export All** in the upper-right corner to download the entire overview for the selected period, regardless of any filters applied. The file is exported in CSV format.

{% hint style="info" %}
You can find the exported file in the default download location of your browser.
{% endhint %}

***

## Further Resources

**Knowledge Base**

* [Which system events are logged by Enginsight on monitored hosts?](https://docs.enginsight.com/docs/knowledge-base/english/logging/which-system-events-are-logged-by-enginsight-on-monitored-hosts)
* [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)
* [How can I monitor object access on Windows systems with Enginsight in the system events?](https://docs.enginsight.com/docs/knowledge-base/english/file-integrity-monitoring-fim/how-can-i-monitor-object-access-on-windows-systems-with-enginsight-in-the-system-events)

***