My AUDIT_EVENTS table shows many ORIGINATING_CONTEXT = 0 records but this is not translated in the documentation. Filtering my audit log by ORIGINATING_CONTEXT = 0 shows most of the actions relating to the gateway such as report execution and config changes, but I am also seeing tag write actions.
Is this 0 value missing from documentation or is something off with my setup?
Documentation:
My AUDIT_EVENTS counts by ORIGINATING_CONTEXT :
Originating context of 0 is likely paired with an actor of 'unknown', meaning that the events happened, were logged, but (for whatever reason) we weren't able to tie them to a specific actor or originating system. The documentation could probably be more clear on this point.
Thanks for the explanation. You are correct that >50% of the records have Actor = 'Unknown', but the rest are my account and 'Scheduled Report'. All of the records have Actor_HOST = 'Unkonwn'.
Ah, yeah. That's a mistake on our part; a scheduled report should certainly be considered a gateway scoped action. I'll make a ticket to get that fixed.