In this article:

• Objective

• Prerequisites

• Steps to follow

• Validation and confirmation

• Tips

• Related topics and articles

 Objective   

Learn how to index archived event files in ADAudit Plus and perform searches to quickly locate specific audit events without restoring them to the working database.

 Prerequisites   

• Administrative access or delegated permission to perform this action in the ADAudit Plus web console is needed.

• Archived event files must be available in the configured archive folder.

• Ensure there is enough free disk space in the installation directory or configured indexing location.

 Steps to follow 

 Step 1: Understand archive searching and indexing

 Archive searches in ADAudit Plus enable you to search for specific events from archived files without loading them into the working database. This provides faster tracking across all log categories.

Important notes

• Archive files must be indexed before they can be searched or viewed as reports.

• Once indexed, you can access reports through links on the same page, but not from the Reports tab. To display data on the Reports tab, use the Restore Archived Events option.

• You can index up to 50 files per log category.

• Each indexed archive file consumes approximately 40–70MB of disk space.

• By default, indexed files are stored in the product installation directory. You can change this location using the Settings link under Search Archived Events > Index Files For Search.

• Always confirm there is sufficient disk space before indexing.

 Step 2: Index archived files for search ing

1. In the ADAudit Plus web console, go to Admin > Configuration > Search Archived Events > Index Files For Search.

2. Choose the timeframe and Log Category that you want to index.

3. Choose the archive files you want to index (up to 50 files per category).

4. Click the Index icon under the Actions column.

5. Once a file is scheduled for indexing, its progress will appear in the status bar on the same page. When indexing completes, you can view the archived data as reports using the links on the left-hand side of the page.

6. Use the search bar within each report to locate specific events precisely.

 Step 3: Use Archive Global Search 

The Archive Global Search option allows you to search across all log categories at once.

1. Go to Archive Global Search.

2. Enter your search query in the provided field.

3. A summary of the results will be displayed across all log categories. Click any result to drill down into detailed reports for that category.

 Step 4: Perform simple searches within indexed archives 

1. In the search area, hover over the left-side box to open the drop-down list.

2. Choose the search field and operator.

3. Enter your search text in the box.

4. Click the green search icon. Relevant reports matching your search will be displayed below.

Note:

The search box supports wildcard characters * and ?. For example:

• ad* returns all words starting with "ad" (admin, administrator, adon, etc.).

• ad*n returns words starting with "ad" and ending with "n" (admin, adon, etc.).

If your search text contains multiple words separated by spaces, enclose the text in double quotation marks.

 Step 5: Perform advanced searches 

For complex, multiple-query searches:

1. Type your first search text in the search box.

2. Click the AND/OR button to open the advanced search panel.

3. In the second search box, enter another search term and click AND or OR to append it to your query.

4. To group queries, drag and drop brackets where needed.

5. To delete a query, hover over it to display the delete button and click the button.

6. To change operators, click the operator to toggle between AND and OR.

7. When your query is ready, click the Search button to retrieve matching reports.

 Validation and confirmation 

• Verify that the indexing completes successfully and the status bar shows no errors.

• Run test searches to confirm that the archived data is searchable and reports generate as expected.

• Confirm that the search results reflect all expected event categories and timeframes.

 Tips 

• Only index the date ranges and categories you need to avoid unnecessary disk space usage.

• Use Archive Global Search for quick overviews across all categories.

• Regularly monitor the size of indexed files to maintain optimal system performance.

 Related topics and articles 

• How to restore archived events in ADAudit Plus