Is there an audit log available for access to the Web Reports?

Yes, EventSentry Web Reports logs all authentication attempts (successful and failed) for auditing and security purposes.

On Windows, events are written to both the log file and the Application event log with source EventSentry Web Reports.

Log File Location

By default, the authentication logs are located at:
C:\Program Files\EventSentry\WebReports\web\logs\auth-<timestamp>.log
Where <timestamp> represents the date (e.g., auth-yyyymmdd.log).

Log File Content

Each log line details an authentication attempt and typically includes the following:

Timestamp: Date and time of the attempt.
Username: Username used for login.
Source IP Address: IP address of the user attempting to log in.

Example messages:

New user
2025-09-30 08:32:54.480 INFO auth - New user created with the username sjackson from 172.21.2.6

Successful logon
2025-10-16 10:11:54.520 INFO auth - User admin has logged on successfully from 10.0.0.16

Successful 2FA logon
2025-10-04 10:08:54.240 INFO auth - User bsmith has logged on successfully with two-factor authentication via email from 172.16.1.12

Authentication Failure
2025-10-28 08:52:50.730 ERROR auth - Failed logon attempt bsmith from 192.168.1.102

Authentication Failure / Incorrect 2FA code
2025-11-02 11:52:48.520 ERROR auth - Failed logon attempt rtaylor using two-factor authentication code from 172.21.3.15

Authentication Failure / Expired 2FA code
2025-10-30 07:14:48.520 ERROR auth - Failed logon attempt jjohnson using expired two-factor authentication code from 192.168.21.18

Please note the authentication logs are rotated daily.