EMC SourceOne™ Auditing and Reporting with the EMC Di scovery Manager database ... Auditing and Reporting. 11. 4. This chapter provides an overview of ... Auditing affects: † System

EMC Corporation Corporate Headquarters:

Hopkinton, MA 01748-9103

1-508-435-1000 www.EMC.com

EMC® SourceOne™ Auditing and ReportingVersion 7.1

Installation and Administration Guide302-000-177

REV 01

EMC SourceOne Auditing and Reporting Version 7.1 Installation and Administration Guide2

Copyright © 2013 EMC Corporation. All rights reserved. Published in the USA.

Published September, 2013

EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice.

The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license.

EMC2, EMC, and the EMC logo are registered trademarks or trademarks of EMC Corporation in the United States and other countries. All other trademarks used herein are the property of their respective owners.

For the most up-to-date regulatory document for your product line, go to EMC Online Support (https://support.emc.com).

http://support.emc.com

http://support.emc.com

EMC SourceOne Auditing and Reporting Version 7.1 Installation and Administration Guide 3

Contents ........................................................................................................................... 3

Preface.............................................................................................................................. 7

Chapter 1 Auditing and ReportingIntroduction ....................................................................................... 12Overview of auditing ....................................................................... 15Overview of reporting...................................................................... 22Working with reports ....................................................................... 30

Chapter 2 Installing EMC SourceOne ReportingSourceOne prerequisites .................................................................. 40Planning and installation checklist ................................................ 41Pre-deployment planning................................................................ 43Hardware and software requirements........................................... 45Installing SQL Server Reporting Services ..................................... 47Configuring SQL Server Report Server ......................................... 56Verifying installation of SQL Server Report Server ..................... 71Installing EMC SourceOne reports................................................. 72Installing EMC Discovery Manager reports ................................. 77Controlling access to EMC SourceOne and Discovery Manager reports................................................................................................. 81Authenticating with the EMC SourceOne Activity database..... 85Authenticating with the EMC Discovery Manager database..... 87Configuring Internet Explorer for all EMC reports ..................... 88Maintaining the installation ............................................................ 89

Contents


Contents

Chapter 3 Running EMC SourceOne ReportsAccessing EMC SourceOne reports................................................ 92Mapped Folder Permissions Audit report .................................... 97Mapped Folder Effective Permissions report ............................. 101Specifying parameters for Search Audit reports (Search)......... 104Consideration for Search Audit Reports ..................................... 106Search Activity report (Search) ..................................................... 108Search Copy report (Search)........................................................... 111Search Delete report (Search) ........................................................ 114Search Restore report (Search) ...................................................... 117File Search Restore report (Search)............................................... 120Documents Copied report (Search).............................................. 124Documents Deleted report (Search) ............................................. 128Documents Restored report (Search) ........................................... 132Files Restored report (Search) ....................................................... 136Documents Viewed report (Search) ............................................. 140Data Source Processing report ...................................................... 144Email Management Activity dashboard ..................................... 158Search Activity dashboard ............................................................ 173SharePoint Management Activity Dashboard............................ 180Files Management Activity Dashboard....................................... 193

Chapter 4 Running EMC Discovery Manager ReportsAccessing Discovery Manager reports ........................................ 208Search Activity report (Discovery Manager) .............................. 210Assign to Hold Folder report (Discovery Manager).................. 218Delete from Hold Folder report (Discovery Manager) ............. 224Documents Viewed report (Discovery Manager) ...................... 230Export Activity report (Discovery Manager).............................. 237

Chapter 5 Customizing ReportsChanging parameter defaults ....................................................... 248Adding a company logo ................................................................ 253

Chapter 6 Best Practices Auditing and ReportingAuditing and reporting best practices......................................... 258

5EMC SourceOne Auditing and Reporting Version 7.1 Installation and Administration Guide

Contents

Chapter 7 Troubleshooting Auditing and ReportingTroubleshooting EMC SourceOne auditing ................................ 262Troubleshooting EMC SourceOne reporting............................... 264

Index .............................................................................................................................. 267


Contents


Preface

As part of an effort to improve and enhance the performance and capabilities of its product lines, EMC periodically releases revisions of its hardware and software. Therefore, some functions described in this document may not be supported by all versions of the software or hardware currently in use. For the most up-to-date information on product features, refer to your product release notes.

If a product does not function properly or does not function as described in this document, please contact your EMC representative.

Audience This document is part of the EMC® SourceOne™ documentation set, and is intended for use by:

◆ EMC SourceOne Email Management system administrators who are processing email, Microsoft SharePoint content, or file content, and who want to run reports on system processing statistics and audited SourceOne activities.

◆ EMC SourceOne Discovery Manager administrators and compliance officers who want to run reports on audited Discovery Manager operations.

8 EMC SourceOne Auditing and Reporting Version 7.1 Installation and Administration Guide

Preface

Conventions used in this document

EMC uses the following conventions for special notices.

Note: A note presents information that is important, but not hazard-related.

IMPORTANT!An important notice contains information essential to operation.

Typographical conventions

EMC uses the following type style conventions in this document:

Normal Used in running (nonprocedural) text for:• Names of interface elements (such as names of windows,

dialog boxes, buttons, fields, and menus)• Names of resources, attributes, pools, Boolean expressions,

buttons, DQL statements, keywords, clauses, environment variables, filenames, functions, utilities

• URLs, pathnames, filenames, directory names, computer names, links, groups, service keys, file systems, notifications

Bold: Used in running (nonprocedural) text for:• Names of commands, daemons, options, programs,

processes, services, applications, utilities, kernels, notifications, system call, man pages

Used in procedures for:• Names of interface elements (such as names of windows,

dialog boxes, buttons, fields, and menus)• What user specifically selects, clicks, presses, or types

Italic: Used in all text (including procedures) for:• Full titles of publications referenced in text• Emphasis (for example a new term)• Variables

Courier: Used for:• System output, such as an error message or script • URLs, complete paths, filenames, prompts, and syntax when

shown outside of running text

Courier bold: Used for:• Specific user input (such as commands)

Courier italic: Used in procedures for:• Variables on command line• User input variables

< > Angle brackets enclose parameter or variable values supplied by the user

[ ] Square brackets enclose optional values


Preface

Where to get help EMC support, product, and licensing information can be obtained as follows.

Product information — For documentation, release notes, software updates, or information about EMC products, go to EMC Online Support at:

https://support.emc.com

Technical support — Go to EMC Online Support and click Service Center. You will see several options for contacting EMC Technical Support. Note that to open a service request, you must have a valid support agreement. Contact your EMC sales representative for details about obtaining a valid support agreement or with questions about your account.

Online communities — Visit EMC Community Network at https://community.emc.com for peer contacts, conversations, and content on product support and solutions. Interactively engage online with customers, partners, and certified professionals for all EMC products.

Your comments Your suggestions will help us continue to improve the accuracy, organization, and overall quality of the user publications. Send your opinions of this document to:

[email protected]

| Vertical bar indicates alternate selections - the bar means “or”

{ } Braces indicate content that you must specify (that is, x or y or z)

... Ellipses indicate nonessential information omitted from the example

https://support.emc.com

mailto:[email protected]


Preface

Auditing and Reporting 11

4

This chapter provides an overview of EMC SourceOne auditing and reporting, and includes the following topics:

◆ Introduction ........................................................................................ 12◆ Overview of auditing ........................................................................ 15◆ Overview of reporting....................................................................... 22◆ Working with reports ........................................................................ 30

Auditing and Reporting



IntroductionThe following sections describe EMC SourceOne auditing and reporting features.

What is audited?EMC SourceOne audits the following information:

◆ Changes to user permissions on mapped folders. Refer to “Auditing of changes to user permissions on mapped folders” on page 18.

◆ For SourceOne Search, all search operations that were performed using the Administrator search type, and if configured, selected search operations for specified users and document details. Refer to “Auditing of SourceOne Search operations” on page 15.

◆ For SourceOne Discovery Manager, all collection searches, documents viewed, assign to and delete from matter with hold folder operations, and exports. Refer to “Auditing of Discovery Manager operations” on page 20.

Where is audit information stored?For SourceOne Search operations and mapped folder permissions, audit information is stored in the SourceOne Activity database.

For the following SourceOne Discovery Manager operations, audit information is stored in the SourceOne Discovery Manager database:

◆ Collection searches

◆ Assign to matter with hold folder

◆ Delete from matter with hold folder

◆ Exports

You can view audit information in EMC SourceOne reports and Discovery Manager reports.

Introduction 13


What audit reports are available?The following audit reports are available:

◆ Search Audit reports for SourceOne Search

• Search Activity

• Search Copy

• Search Delete

• Search Restore

• Documents Copied

• Documents Deleted

• Documents Restored

• Documents Viewed

• Files Restored

• File Search Restore

◆ Search Audit reports for SourceOne Discovery Manager

• Search Activity

• Documents Viewed

• Assign to Hold Folder

• Delete from Hold Folder

• Export Activity

◆ Configuration reports for SourceOne

• Mapped Folder Permissions Audit

• Mapped Folder Effective Permissions



What other reports are available?System processing reports are also available.

Refer to “System processing statistics” on page 19.

What are the prerequisites for reports?Install SQL Server Reporting Services 2008, 2008 R2, or 2012 and EMC SourceOne reports, as described in “Installing EMC SourceOne Reporting” on page 39.

How do I run reports?EMC SourceOne administrators, legal users, and compliance officers can use Internet Explorer 7 or higher to access Microsoft SQL Server Reporting Services and run EMC SourceOne reports.

Refer to:

◆ “Running EMC SourceOne Reports” on page 91

◆ “Running EMC Discovery Manager Reports” on page 207

Overview of auditing 15


Overview of auditingRefer to:

◆ “Auditing of SourceOne Search operations” on page 15

◆ “Auditing of changes to user permissions on mapped folders” on page 18

◆ “System processing statistics” on page 19

◆ “Auditing of Discovery Manager operations” on page 20

Auditing of SourceOne Search operationsRefer to:

◆ “Considerations for SourceOne Search auditing” on page 15

◆ “About search roles” on page 16

◆ “Audited Search operations” on page 17

◆ “Capturing document details” on page 18

Considerations for SourceOne Search auditing◆ Auditing of SourceOne File Restore operations is a "go forward"

solution requiring upgrade to version 7.1 or later of EMC SourceOne Email Management. Previously executed File Restore operations will not have audit available.

◆ Auditing of SourceOne Search operations and mapped folder permissions is a “go forward” solution requiring upgrade to version 6.8 or later of EMC SourceOne Email Management. Previously run Web Search operations will not have audit available.

◆ By design, auditing of search operations performed using the Administrator search type is on by default and cannot be turned off by the EMC SourceOne system administrator.

◆ Auditing of Administrator search result views is always enabled.



◆ Auditing affects:

• System performance, as a result of additional processing required to store extra data

• Storage, as a result of storing additional data in the EMC SourceOne Activity database

• Reporting performance, as a result of generating reports against a growing volume of data stored in the EMC SourceOne Activity database

◆ Capturing document-level data for Administrator Copy To, Restore, or Delete operations may affect the performance of those operations.

About search rolesAuditing recognizes two search roles, based on the type of search that is performed in EMC SourceOne Search, as described in the following table.

Refer to the EMC SourceOne Email Management Administration Guide, "Configuring Mapped Folders" for more information about search types and the associated permissions required on mapped folders.

Note: An Administrator search role and a EMC SourceOne system administrator are distinct concepts and are not necessarily the same person. A EMC SourceOne system administrator cannot perform Administrator searches until he is granted Administrator permission on the mapped folders that he wants to search.

Table 1 Search roles and search types

Search role recognized by auditing and reporting

Search type in EMC SourceOne Search What is audited

Administrator Administrator All searches performed using the Administrator search type are audited.

Audited User My Items, My Contributed Items, All Items

Searches performed using the My Items, My Contributed Items, or All Items search types are audited for a user only if the user is explicitly identified as an audited user. Typically, audited users are certain managers and executives who are required to have their searches audited.



Audited Search operationsThe following Search operations are always audited for the Administrator search role:

◆ Search

◆ View/preview search results

◆ Delete

◆ Restore

◆ Copy To

The following Search operations can be audited for the Audited User search role (specified users who use the My Items, My Contributed Items, or All Items search types):

◆ Search

◆ View/preview search results

◆ Delete

◆ Restore

To configure auditing of search operations for audited users, refer to in the EMC SourceOne Email Management Administration Guide, "Configuring Applications and Web Services" > “Auditing Search operations.”

To view the audited information, run the following reports, described in “Running EMC SourceOne Reports” on page 91:

◆ Search Activity dashboard

◆ Search Activity report

◆ Search Copy report

◆ Search Delete report

◆ Search Restore report

◆ File Search Restore report



Capturing document detailsFor the Administrator search role, you can choose to capture document details for the copy, delete, and restore operations performed in Search. Document views are always audited for the Administrator search role.

For the Audited User search role, you can choose to capture document details for the delete and restore operations performed in Search. You can also choose to audit document views.

The purpose of this level of audit is not to capture everything about the document but rather to capture enough information to identify the item and the intent of the operation performed on it.

To configure auditing of document details, refer to in the EMC SourceOne Email Management Administration Guide, "Configuring Applications and Web Services" > “Auditing Search operations.”


◆ Documents Copied

◆ Documents Deleted

◆ Documents Restored

◆ Documents Viewed

◆ Files Restored

Auditing of changes to user permissions on mapped foldersChanges to user permissions on EMC SourceOne mapped folders are always audited. No auditing configuration is required.


◆ Mapped Folder Permissions Audit

◆ Mapped Folder Effective Permissions

Note: Auditing of SourceOne mapped folder permissions is a “go forward” solution requiring upgrade to version 6.8 or later of EMC SourceOne Email Management. In the Mapped Folder Effective Permissions report, you can view permissions that were in effect at the time EMC SourceOne 6.8 was installed and for dates after installation, but not for dates before installation.



System processing statisticsSystem processing statistics are captured while the data is processed by a EMC SourceOne Email Management activity, and (if the components are installed) SharePoint activities and Files activities. System reports are for informational purposes only. The statistics are stored in the Activity database, and include the following information:

◆ Job ID

◆ Data source (such as the name of a mailbox)

◆ Mapped folder name

◆ Number and size of processed, duplicate, failed, and discarded items

Note: “Discarded” means skipped or discarded due to applied filters or rules.

◆ Number and size of items with attachments

◆ Size of the data source before and after processing

System reports will show statistics for email processing that occurred before EMC SourceOne 6.8 or later was installed. SharePoint and File data are captured starting with EMC SourceOne 7.0, EMC SourceOne for Microsoft SharePoint 7.0, and EMC SourceOne for File Systems 6.8.

To view system processing information, run the following reports, described in “Running EMC SourceOne Reports” on page 91:

◆ Data Source Processing report

◆ Email Management Activity Dashboard

◆ SharePoint Management Activity Dashboard

◆ Files Management Activity Dashboard



Auditing of Discovery Manager operationsSourceOne audits:

◆ Collection searches that are performed by Discovery Manager users with the Discovery Manager client or with the DMCollect utility

◆ Assign to matter with hold folder operations

◆ Delete from matter with hold folder operations

◆ Documents viewed in the Collection Area, the Matter Review Area, the export Items tab, and the export Failures tab

◆ Exports

These operations are always audited. No auditing configuration is required.

To view the audited information, run the appropriate Discovery Manager report, described in “Running EMC Discovery Manager Reports” on page 207.

Considerations for SourceOne Discovery Manager auditing◆ Auditing of Discovery Manager collection searches is a "go

forward" solution requiring upgrade to version 6.8.1 or later of both EMC SourceOne Email Management and EMC SourceOne Discovery Manager. Previously executed collection searches will not have audit available.

◆ Auditing of Discovery Manager operations (assign to hold folder, delete from hold folder, document views, export) is a "go forward" solution requiring upgrade to version 7.0 or later of both EMC SourceOne Email Management and EMC SourceOne Discovery Manager. Previously executed operations will not have audit available.

◆ By design, auditing is on by default and cannot be turned off by the EMC SourceOne system administrator or the Discovery Manager Application Administrator.



◆ Auditing affects:

• System performance, as a result of additional processing required to store extra data

• Storage, as a result of storing additional data in the EMC SourceOne Discovery Manager database

• Reporting performance, as a result of generating reports against a growing volume of data stored in the EMC SourceOne Discovery Manager database

◆ Audits may not be complete if connectivity is lost to the Discovery Manager database or the SourceOne Activity database.

◆ If the matter has a hold folder, then operations that assign items to a matter or remove items from a matter are audited. If the matter does not have a hold folder, then these operations are not audited because nothing is copied to or deleted from an archive folder.

◆ If a hold folder is associated with a matter after items were assigned to the matter, then the assigned items are automatically copied to the hold folder. This operation is audited. However, in this case, the person who associated the hold folder with the matter is audited as the user who performed the assign operation, instead of the person who originally assigned the items to the matter.

◆ Document-level auditing is captured for items viewed in the Collection Area, the Matter Review area, the export Items tab, and the export Failures tab of the Discovery Manager client. An audit occurs each time a document is viewed in a matter. If the same document is viewed multiple times, the view operation is audited each time.

Document-level auditing is not captured for assign to hold folder operations and delete from hold folder operations.

Note: For reporting considerations and limitations, refer to “Considerations and limitations for reports” on page 23.



Overview of reportingRefer to:

◆ “Types of reports” on page 22

◆ “Search roles for SourceOne Search reports” on page 23

◆ “Prerequisites for SourceOne Search reports” on page 23

◆ “Considerations and limitations for reports” on page 23

Types of reportsEMC SourceOne provides the following types of reports:

◆ Configuration reports - Display the auditing information captured for changes to user permissions on EMC SourceOne mapped folders.

Refer to Table 5 on page 93 for a list of Configuration reports.

◆ Search Audit reports for SourceOne Search - Display the information captured for search operations and the documents processed in those operations, based on the auditing configuration.

To configure auditing of search operations, refer to in the EMC SourceOne Email Management Administration Guide, Chapter 8, "Configuring Applications and Web Services" > “Auditing Search operations.”

Refer to:

• “Search roles for SourceOne Search reports” on page 23

• “Prerequisites for SourceOne Search reports” on page 23

• Table 6 on page 94 for a list of Search Audit reports for SourceOne Search

◆ System reports - Display statistics about mailbox and PST processing, email management activities, SharePoint activities, Files activities, and search activities for both Web Search and Discovery Manager.

Refer to Table 7 on page 95 for a list of System reports.

Overview of reporting 23


◆ Search audit reports for SourceOne Discovery Manager - Displays information captured for collection searches, assign to matter with hold folder operations, delete from matter with hold folder operations, exports, and documents viewed.

These operations are always audited. No configuration is required.

Search roles for SourceOne Search reportsThe role of the search user is displayed in Search Audit reports and in the Search Activity dashboard. Auditing recognizes two search roles, based on the type of search that is performed in EMC SourceOne Search, as described in “About search roles” on page 16.

Prerequisites for SourceOne Search reportsTo see information about user searches in reports, configure audited users.

To see document details in Search Audit reports for restore, copy to, or delete operations, configure the appropriate Capture Document Details auditing option.

Refer to the EMC SourceOne Email Management Administration Guide, "Configuring Applications and Web Services" > “Auditing Search operations.”

Considerations and limitations for reportsRefer to:

◆ “General considerations” on page 24

◆ “Considerations for SourceOne Search Audit reports” on page 26

◆ “Considerations for Configuration reports” on page 27

◆ “Considerations for System reports” on page 27

◆ “Considerations for Discovery Manager reports” on page 28



General considerationsConsider the following:

BrowserYou must use Microsoft Internet Explorer 7.0 or higher to access EMC SourceOne reports. For more information, refer to http://msdn.microsoft.com/en-us/library/ms156511.aspx .

Input of date and time in reports◆ The input of date and time in report parameters depends on the

regional settings of your SQL Server Reporting Services computer.

◆ Date parameter fields can accept times in any format including AM/PM. This ensures that time reporting is consistent and unambiguous across cultures and languages, especially for cultures that do not have an AM/PM designator.

◆ If you specify a time in the Data Source Processing report’s Begin Date or End Date parameter, the time is ignored. The report displays an entire day’s worth of data at minimum. Data for this report is captured and displayed at the daily level.

Display of date and time in reports◆ The times shown in EMC SourceOne Search Audit,

Configuration, and System reports are based on the time zone in which the SQL Server resides that hosts the SourceOne Activity database, not the time zone of the client computer.

◆ The times shown in the Discovery Manager Search Activity report are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer.

◆ SQL Server does not store the daylight savings offset, so the time shown in reports does not adjust for daylight savings time. For example, if your SourceOne Activity database and Discovery Manager database reside on a SQL Server that is in the Eastern Time zone (GMT-05:00), and you enabled the "Automatically adjust clock for daylight savings changes" option in Windows Date and Time Properties, the reports display the time zone as GMT -4:00.

◆ The display of date and time is normalized to ISO/ODBC 24-hour format (YYYY-MM-DD HH:mm:ss) in all reports, including report data, the Report Configuration section, header, and footer.

http://msdn.microsoft.com/en-us/library/ms156511.aspx



◆ Tooltips dates do not use the 24-hour format, but use the regional settings format of the SQL Server Reporting Services computer instead.

◆ For weekly calculations, Monday is considered the first day of the week.

◆ Q1 is the January-to-March quarter.

Default sorting of dates◆ In Search Audit reports, the Date column is sorted in ascending

order (oldest date first). This default sorting is intended to benefit users who want to view search audit history in chronological order.

◆ In Configuration reports, the Date column is sorted in descending order (newest date first). This default sorting is intended to benefit system administrators who want to view the latest changes.

◆ To change the sort order, click on the Date column header.

English-only reportsIn this release, the reports are in English only.

NavigationIn drill through reports and in the Email Management Activity dashboard, when you select another period and then rerun the report, bread crumb links and the Report Manager link are not available for navigation. This is a limitation of Microsoft SQL Server Reporting Services. As a workaround, enable tabbed viewing in Internet Explorer so that you can navigate more easily between reports.

I/O activity increases on SQL ServerWhen you run an EMC SourceOne report, for a short time there can be significant I/O activity on the SQL Server that hosts the EMC SourceOne Activity database. When you run a Discovery Manager report, for a short time there can be significant I/O activity on the SQL Server that hosts the EMC SourceOne Discovery Manager database. The amount of I/O activity depends on:

◆ the audit records being requested

◆ for EMC SourceOne system reports, the amount of historical data in the Activity database

When you refresh a report, database I/O activity may occur.



Considerations for SourceOne Search Audit reportsConsider the following:

SourceOne Search Audit reports display “go forward” dataSourceOne Search Audit reports display information that is captured after EMC SourceOne 6.8 or later is installed and after the auditing of search operations is configured.

Sender information in Search Delete reportsFor Search Delete reports, the Sender information is captured for audit purposes only if the From column is included in the search results. Refer to “Setting preferences” in the EMC SourceOne Search User Guide.

Document-level auditing◆ Auditing information for a document view or preview by a user

is captured the first time the document is viewed or previewed by that user in a EMC SourceOne search. If the document is viewed or previewed again in the same search, the information is not captured again. This behavior is by design, to prevent duplicate information from filling the database. If the same document is accessed in a different search, then another audit is recorded.

◆ If document-level auditing is enabled, and a user views or previews a document during a Copy To or Restore operation in Search, then EMC SourceOne captures additional document information that was not captured during the Copy To or Restore operation.

Multi-select deletesYou may see different audit details in reports involving a multi-select delete.

Typically, the user views or previews a document before deleting it, so there may be two or more document view audits (if enabled) before a multi-select deletion. Document view audits usually audit more precise document details than delete audits, due to the source of the information. Therefore, if a document is audited in a view operation and then deleted, there may be more complete or different information recorded in the document view audit than is recorded in the delete audit.



If the document has already been audited for some other reason before the deletion occurs, then the deletion will not overwrite the document details in the database. Documents that were not audited before the deletion may have different information recorded in the database compared to documents that were audited for another reason (for example, being viewed).

Copy To operations and Restore operationsIn a Search Copy report and in a Search Restore report:

◆ If a Copy To or Restore operation fails during the retrieval of an item, then no audit information is captured. The item is reported in neither the Audited column nor the Copied/Restored column.

◆ If a Copy To or Restore operation succeeds during the retrieval of an item but the copy or restore fails, then the audit information is captured. The item is reported in the Audited column. However, because the copy or restore failed, the item is not reported in the Copied/Restored column.

◆ If a Copy To or Restore operation succeeds during the retrieval of an item and succeeds during the copy or restore, then the audit information is captured. The item is reported in both the Audited column and in the Copied/Restored column.

Considerations for Configuration reportsConfiguration reports display “go forward” data captured after EMC SourceOne 6.8 or later is installed.

Considerations for System reportsThe Data Source Processing report, Email Management Activity Dashboard, SharePoint Management Activity Dashboard, and Files Management Activity Dashboard are not audit reports, and are informational only.

The Data Source Processing report and the Email Management Activity Dashboard will show information for email content that was captured in the Activity database before EMC SourceOne 6.8 or later was installed.

The SharePoint Management Activity Dashboard report is available if EMC SourceOne for Microsoft SharePoint 7.0 or later is installed on your SourceOne 7.0 or later system.

The Files Management Activity Dashboard report is available if EMC SourceOne for File Systems 6.8 or later is installed on your SourceOne 7.0 or later system.



The first row in the Email Management Activity Dashboard, SharePoint Management Activity Dashboard, and Files Management Activity Dashboard may display zeroes (0) for all columns. This is a known issue.

Considerations for Discovery Manager reports

Discovery Manager reports display “go forward” dataDiscovery Manager Search Activity reports display information that is captured after EMC SourceOne 6.8.1 and Discovery Manager 6.8.1 are installed. The auditing of Discovery Manager search operations is separate from the auditing of SourceOne Search operations.

Discovery Manager Assign to Hold Folder, Delete from Hold Folder, Documents Viewed, and Export Activity reports display information that is captured after EMC SourceOne 7.0 and Discovery Manager 7.0 are installed.

These Discovery Manager operations are always audited. No auditing configuration is required.

Considerations for Discovery Manager Search Activity reportThe Archive Hits column displays the number of items found in the archive, including duplicates, that matched collection search criteria. This count may not match the number of items displayed in Discovery Manager search results. By design:

◆ Discovery Manager deduplicates search results, and only lists a single instance for each message in results.

◆ Re-running a Discovery Manager search produces differential search result sets. For successive runs of the same search, Discovery Manager lists only messages that were not found in the previous run.

◆ The maximum number of results a user gets depends on whether the user specifies a Maximum Search Results value that is less than, greater than, or an exact multiple of 5,000 (the internal batch size used to put search results into the database). For more information, refer to "Behavior of Maximum Search Hits (Maximum Search Results)" in the EMC SourceOne Discovery Manager User Guide.



Considerations for Discovery Manager Assign to Hold Folder report◆ Assign to hold folder operations can encounter duplicates in two

situations:

• The item was found in multiple mapped folders during search.

• The item is already in the hold folder because the same item was selected again to be assigned or multiple matters share the same hold folder.

If an item is found in multiple mapped folders during search, it only appears once in search results in the Discovery Manager client, but each occurrence is counted in the audit record.

Considerations for Discovery Manager Delete from Hold Folder report◆ Items that display a Copy Failed status in Discovery Manager

will be audited when they are deleted from a matter only if a hold folder is associated with the matter.

Considerations for Discovery Manager Documents Viewed report◆ A document can be viewed in the Collection Area, the Matter

Review area, the export Items tab, and the export Failures tab of the Discovery Manager client. An audit is captured each time a document is viewed in these areas. The Documents Viewed report indicates the area in which the document was viewed.

◆ If a document was viewed in the Collection Area, then the Documents Viewed report includes an Associated Search Details section.

◆ If a document was viewed in the Matter Review area, the export Items tab, or the export Failures tab, then the Documents Viewed report does not include an Associated Search Details section.



Working with reportsThis section describes the features common to all SourceOne reports, except as noted.

Refer to:

◆ “Display features in EMC SourceOne and Discovery Manager reports” on page 30

◆ “Using the report toolbar” on page 34

Display features in EMC SourceOne and Discovery Manager reportsRefer to:

◆ “Maximum row count warning” on page 30

◆ “Expanding sections and rows” on page 31

◆ “Tooltips” on page 32

◆ “Displaying GMT date and time” on page 32

◆ “Report Configuration section” on page 32

Maximum row count warningIf a report returns more rows than are specified by the hidden MaxRowCount parameter:

◆ The report displays the maximum number of rows.

◆ A warning is displayed at the top of the report, for example:

Figure 1 Maximum row count exceeded

Note: (The warning is not displayed for the Mapped Folder Effective Permissions report, the Email Management Activity dashboard, and the Search Activity dashboard.)

To change the value of the MaxRowCount parameter for a report, refer to Chapter 8, “Customizing Reports.”

Working with reports 31


Expanding sections and rowsBy default in Search Audit reports, the Expand All Groups parameter is set to False, so sections and rows are not expanded in reports.

◆ To expand one section or row, click the plus sign (+) next to the section or row.

◆ To expand all sections and rows, before you run the report select the Expand All Groups: True option in the report parameters area.

◆ To change the Expand All Groups default to True, refer to Chapter 8, “Customizing Reports.”

Figure 2 Example - Report Configuration section, Search Activity report (Search)

Figure 3 Example - Report Configuration section, Search Activity report (Discovery Manager)



Figure 4 Example - Search Details, Search Activity report (Search)

TooltipsTooltips are displayed at various places in reports, such as on graphs and links.

Displaying GMT date and timeTo display the GMT date and time in SourceOne Search Audit reports and Discovery Manager Search Activity reports, hover the mouse over the date.

Figure 5 GMT date and time

Report Configuration sectionThe following reports include a Report Configuration section, described in Table 2:

◆ SourceOne reports: Search Audit reports, Configuration reports, and the Data Source Processing report

◆ Discovery Manager Search Audit reports

For examples of Report Configuration sections, refer to Figure 2 on page 31 and Figure 3 on page 31.



Table 2 Report Configuration section

Parameter Description

Duration/Date (SourceOne Search Audit reports and Data Processing reports; Discovery Manager Search Audit reports)The label depends on how you specified a date:• Duration: The option that you selected for the Period parameter.• Date: The date range that you specified in the Begin Date and

End Date parameters.

Effective Date (SourceOne Configuration reports) The date you specified for the Date parameter.The effective date displayed in the reports reflects the date that you specified, which does not directly correspond with the value used in the SQL query. If you specify a date without a time, then the date is modified to the end of the day, rather than the start. The effective date shown in the report is left as is, to reflect your intent rather than the internal processing.

Mapped Folder (SourceOne Configuration reports) The folder you specified for the Mapped Folder parameter.

Folder User (SourceOne Configuration reports) The user you specified for the Folder User parameter.

User (SourceOne Search Audit reports; Discovery Manager Search Audit reports)The option that you selected for the User parameter.

Matter (Discovery Manager Search Audit reports) The matter you selected for the Matter parameter.

Max Row Count The maximum number of rows in the report. The default is 10000.To change this value, refer to Chapter 8, “Customizing Reports.”

Execution Time The date and time on which this report ran.

Executed By The login of the user who ran this report.

Report Time Zone For SourceOne reports, the time zone in which the SQL Server resides that hosts the SourceOne Activity database.For Discovery Manager reports, the time zone in which the SQL Server resides that hosts the Discovery Manager database.



Using the report toolbarUse the report toolbar to navigate, search, export, and print reports.

Figure 6 Report toolbar - SQL 2008 R2

Figure 7 Report toolbar - SQL 2008

Refer to:

◆ “Navigating reports” on page 34

◆ “Searching reports” on page 35

◆ “Adjusting display of reports” on page 35

◆ “Exporting reports” on page 35

◆ “Printing reports” on page 37

Navigating reportsUse the arrow buttons in the report toolbar to navigate a multi-page report.

Report toolbar - navigation

◆ First page

◆ Previous page

◆ Next page

◆ Last page

To go directly to a specific page, type the page number in the text box, then press Enter.



Searching reportsTo search a report:

1. In the report toolbar, type a search string in the text box.

Figure 8 Example - Report toolbar - search string

2. Click Find.

3. To go to the next occurrence of the search string, click Next.

Adjusting display of reportsTo adjust the display of reports on screen, select a zoom factor (magnification percent) in the report toolbar.

Figure 9 Report toolbar - zoom

Exporting reportsBy default, reports are generated in HTML format.

You can export a report in a variety of formats:

◆ PDF

◆ MHTML (web archive)

◆ Excel

◆ TIFF file

◆ Word

Note: Although XML and CSV export formats are available in Reporting Services, in this release, export of EMC SourceOne reports to XML and CSV is not supported.



The report is exported as displayed on screen; sections and groups that are not expanded on screen will remain unexpanded when exported. Graphs are exported to PDF, MHTML, TIFF, and Word as displayed on screen.

ProcedureTo export a report:

1. If you want sections or groups to display as expanded in the exported format, you must expand them on screen.

2. For SQL 2008 R2:

a. Click the dropdown arrow next to the Export icon.

b. Select an export format.

c. Click the Export icon.

Figure 10 SQL 2008 R2 - Export icon

3. For SQL 2008:

a. In the field next to the Export button in the report toolbar, select an export format.

b. Click Export.



Printing reports

IMPORTANT!Use the report toolbar to print reports. If you use your browser’s Print icon or File > Print instead, reports will not print correctly.

The report is printed as displayed onscreen; sections and groups that are not expanded onscreen will remain unexpanded when printed. Graphs are printed as displayed onscreen.

To print a report:

1. Click the Print icon in the report toolbar.

Figure 11 Report toolbar SQL 2008 R2 - Print icon

Figure 12 Report toolbar SQL 2008 - Print icon

2. The first time you print a report:

You may see the following message and dialog box:

a. Click OK to close the dialog box.

b. Click the message to allow the download of the ActiveX control. You will see the following dialog box:



3. Click Install to install the client print control.

4. In the Print dialog box, specify print options.

Installing EMC SourceOne Reporting 39

5

EMC SourceOne Reporting is an optional feature in EMC SourceOne Email Management. This chapter describes how to install components of EMC SourceOne Reporting, and includes the following topics:

◆ SourceOne prerequisites ................................................................... 40◆ Planning and installation checklist.................................................. 41◆ Pre-deployment planning ................................................................. 43◆ Hardware and software requirements ............................................ 45◆ Installing SQL Server Reporting Services....................................... 47◆ Configuring SQL Server Report Server .......................................... 56◆ Verifying installation of SQL Server Report Server ...................... 71◆ Installing EMC SourceOne reports.................................................. 72◆ Installing EMC Discovery Manager reports .................................. 77◆ Controlling access to EMC SourceOne and Discovery Manager

reports 81◆ Authenticating with the EMC SourceOne Activity database...... 85◆ Authenticating with the EMC Discovery Manager database...... 87◆ Configuring Internet Explorer for all EMC reports ...................... 88◆ Maintaining the installation ............................................................. 89

Installing EMC SourceOne Reporting



SourceOne prerequisitesBefore you install SourceOne reports, ensure that the following prerequisites have been met. For all reports, and to support the Discovery Manager, SourceOne for File Systems, and SourceOne for Microsoft SharePoint add-on components:

◆ SourceOne Email Management 7.0 must be installed.

◆ SourceOne 7.0 databases must reside on supported versions of SQL Server.

For Discovery Manager reports:

◆ SourceOne Discovery Manager 7.0 must be installed.

◆ The Discovery Manager 7.0 database must reside on supported versions of SQL Server.

For File reports, SourceOne for File Systems 6.8 must be installed.

For SharePoint reports, SourceOne for Microsoft SharePoint 7.0 must be installed.

Planning and installation checklist 41


Planning and installation checklistEMC SourceOne Reporting provides two sets of reports:

◆ EMC SourceOne reports include Search Audit reports for SourceOne Search, Configuration reports, and System reports.

◆ Discovery Manager reports include Search Audit reports for SourceOne Discovery Manager collection searches, assign to hold folder operations, delete from hold folder operations, documents viewed, and exports.

Use the following checklist to plan and install EMC SourceOne Reporting.

Table 3 Checklist: Planning and installing EMC SourceOne Reporting

Activity Refer to

Perform pre-deployment planning. Review SQL Server requirements, considerations and limitations and high availability requirements.

“Considerations and limitations” on page 44.

Review hardware and software requirements for supported versions of Microsoft SQL Server Reporting Services and client host computers.Review software requirements for the EMC SourceOne Reporting client computer.

“Requirements for the report server” on page 45.“Requirements for the report client” on page 46

Install SQL Server Reporting Services. “Installing SQL Server Reporting Services” on page 47.

Configure SQL Server Report Server. “Configuring SQL Server Report Server” on page 56.

Verify the installation of SQL Server Report Server. “Verifying installation of SQL Server Report Server” on page 71.

Install the EMC SourceOne Reports on the SQL Server Report Server.

“Installing EMC SourceOne reports” on page 72.

Install the EMC Discovery Manager Reports on the SQL Server Report Server.

“Installing EMC Discovery Manager reports” on page 77.



8 Set access permissions for EMC SourceOne reports.

“Controlling access to EMC SourceOne and Discovery Manager reports” on page 81.

Set access permissions for Discovery Manager reports.

“Controlling access to EMC SourceOne and Discovery Manager reports” on page 81.

Configure Internet Explorer on client computers. “Configuring Internet Explorer for all EMC reports” on page 88.

Configure EMC SourceOne auditing.

Note: This step applies to the auditing of SourceOne Search operations. It does not apply to Discovery Manager auditing, which is always enabled.

"Configuring Applications and Web Services" > "Auditing search operations" in the EMC SourceOne Email Administration Guide.

Table 3 Checklist: Planning and installing EMC SourceOne Reporting (continued)

Activity Refer to

Pre-deployment planning 43


Pre-deployment planningBefore you install EMC SourceOne Reporting, review the following sections:

◆ “SQL Server Reporting Services requirement” on page 43

◆ “Considerations and limitations” on page 44

◆ “High availability of SQL Server Reporting Services” on page 44

SQL Server Reporting Services requirementEMC SourceOne Reporting requires supported versions of Reporting Services.

Refer to Microsoft for information about license costs.

The SQL Server Report Server can be installed on the same computer as the SourceOne production databases, as indicated by the dotted line in Figure 13.

Figure 13 Server and client configuration for EMC SourceOne Reporting



Considerations and limitationsReview the following considerations and limitations before you install EMC SourceOne reporting.

PerformanceSome of the EMC SourceOne production databases are also used for reporting:

◆ The EMC SourceOne Activity production database is also used for the EMC SourceOne reports.

◆ The EMC SourceOne Discovery Manager production database is also used for the Discovery Manager reports.

Performance is affected by the increased number of database calls and increased disk space usage due to additional auditing. System reports require increased I/O operation.

ScalabilityIf the EMC SourceOne Activity database and the EMC SourceOne Discovery Manager database are hosted on the Enterprise edition of SQL Server, then some of the database tables that store auditing information are partitioned automatically to improve the scalability of auditing. No action is required by the SQL Server database administrator.

Note: Partitioning settings are available in Discovery Manager. Refer to the EMC SourceOne Discovery Manager User Guide.

LanguagesInternet Explorer language settings affect the text generated by SQL Server Reporting Server. However, in this release, the text in EMC SourceOne reports and Discovery Manager reports is displayed in English only.

High availability of SQL Server Reporting ServicesSQL Server Reporting Services cannot be clustered. You can install a separate instance of Reporting Services, as described in Microsoft documentation for scale-out deployment.

Hardware and software requirements 45


Hardware and software requirementsThis section includes the following topics:

◆ “Requirements for the report server” on page 45

◆ “Requirements for the report client” on page 46

Note: Refer to Microsoft SQL Server Reporting Services documentation for additional requirements.

Requirements for the report serverEMC SourceOne reports and Discovery Manager reports are produced using Microsoft SQL Server Reporting Services (SSRS).

You can install Microsoft SQL Server Reporting Services on the same computer as the SourceOne production databases, as long as all hardware and software requirements for Reporting Services are met.

However, running reports against a large data set (such as the EMC SourceOne database or the Discovery Manager database) takes processor time away from the operation of EMC SourceOne or Discovery Manager. The ingestion rate or the performance of other EMC SourceOne operations may be affected when the databases and Microsoft Report Server are on the same computer.

For performance reasons, you may want to install Microsoft Report Server on a separate computer.

Refer to the following topics:

◆ “Hardware requirements for the report server” on page 45

◆ “Software requirements for the report server” on page 46

◆ “Login requirements for installation of the report server” on page 46

Hardware requirements for the report serverThe server on which you plan to install Microsoft SQL Server for use with EMC SourceOne Reporting must meet Microsoft’s minimum or recommended hardware requirements. Refer to Microsoft documentation.



Software requirements for the report serverThe SQL Server server used for EMC SourceOne Reporting requires the following software:

◆ Windows Server 2003 or Windows Server 2008

◆ SQL Server supported version; Standard or Enterprise License

◆ .NET Framework (installed as part of the SQL Server Reporting Server)

Login requirements for installation of the report serverYou must install SQL Server Reporting Services using an account with local administrator privileges on the computer.

Requirements for the report clientThe client computer used to access EMC SourceOne reports and Discovery Manager reports requires:

◆ Internet Explorer to access EMC SourceOne reports and Discovery Manager reports over the intranet through a browser. Recommended: Enable tabbed viewing in Internet Explorer so that you can navigate more easily between reports. Refer to the EMC SourceOne for supported browsers.

Note: After installing EMC SourceOne reports and Discovery Manager reports, add the Report Manager URL to Internet Explorer’s Local Intranet zone, as described in “Configuring Internet Explorer for all EMC reports” on page 88.

◆ Adobe Acrobat Reader to view and print EMC SourceOne reports and Discovery Manager reports in PDF format.

◆ Minimum screen resolution of 1024x768 for standard size monitors, or the equivalent for wide-screen monitors.

Installing SQL Server Reporting Services 47


Installing SQL Server Reporting ServicesThis section describes a single-server, default instance deployment of SQL Server Reporting Services. The Report Server and the Report Server database are installed on the same computer.

For information on planning, installing, and configuring Reporting Services for a scale-out deployment, refer to Microsoft documentation.

This procedure assumes that you are adding the Reporting Services feature to an existing instance of SQL Server with the Database Engine already installed, as shown in Figure 16.

To install SQL Server Reporting Services, on the SQL Server that will be used for EMC SourceOne reports:

1. Log in using an account with local administrator privileges on the computer.

2. Run the SQL Server setup program.

3. In the SQL Server Installation Center, click New installation or add features to an existing installation.

Figure 14 SQL Server Installation Center

The Setup Support Rules page displays information about your system.

4. Click Next.

5. On the Installation Type page, select Add features to an existing instance of SQL Server 2008/2008 R2.

6. Select the name of the instance from the dropdown list.



Figure 15 Installation Type

7. Click Next.

8. On the Feature Selection page, select following features:

• Reporting Services

• Management Tools - Complete

Note: The checkboxes for features that were installed previously are selected by default and are grayed out.



Figure 16 Feature Selection - SQL Server 2008

9. Click Next. The Disk Space Requirements page reports the total disk space available and the total disk space required.

10. Verify that you have enough disk space for the installation.

Figure 17 Disk Space Requirements

11. Click Next.



12. On the Server Configuration page, specify the service accounts (names and passwords) for the Reporting Services and any other SQL Server services you installed.

Note: Microsoft recommends using the Network Service account.

Figure 18 Server Configuration

13. Click Next.



14. On the Reporting Services Configuration page, select the Install, but do not configure the report server option for both existing and new installations.

Figure 19 Reporting Services Configuration

15. Click Next.



16. On the Error and Usage Reporting page, leave the default settings.

Figure 20 Error and Usage Reporting - SQL Server 2008

Figure 21 Error and Usage Reporting - SQL Server 2008 R2



17. Click Next.

18. The Installation Rules page (SQL Server 2008) or the Installation Configuration Rules page (SQL Server 2008 R2) indicates whether or not the installation is ready to proceed.

The status of all items should be Passed or Not Applicable.

Figure 22 Installation Rules - SQL Server 2008



Figure 23 Installation Configuration Rules - SQL Server 2008 R2

19. Click Next.



20. The Ready To Install page lists the installation information that you supplied:

• Verify that the information is correct.

• If the information is not correct, edit the information on the appropriate page of the installation wizard.

Figure 24 Ready To Install

21. When you are ready to proceed with the installation, click Install.

• The Installation Progress page indicates the progress of the installation.

• The Complete page indicates that the installation completed successfully.

22. Click Close.



Configuring SQL Server Report Server

IMPORTANT!Configure the options in the Reporting Services Configuration Manager window in the sequence shown in the left pane. Doing so ensures that each configuration screen is populated correctly.

To configure SQL Server Report Server:

1. On the Start menu, select Start > All Programs > Microsoft SQL Server version > Configuration Tools > Reporting Services Configuration Manager.

2. Continue to each of the following steps, in the order given:

• “Step 1: Connect to the Report Server instance” on page 56

• “Step 2: Specify the service account” on page 57

• “Step 3: Specify the Web Service URL” on page 58

• “Step 4: Specify information about the Reporting Server database” on page 60

• “Step 5: Specify the Report Manager URL” on page 65

• “Step 6: Use defaults for Email Settings” on page 67

• “Step 7: Use defaults for Execution Account” on page 67

• “Step 8: Specify backup information for the encryption key” on page 68

• “Step 9: Use defaults for Scale-out Deployment” on page 70

Step 1: Connect to the Report Server instanceThe Reporting Services Configuration Connection dialog box displays the name of the server running Report Server and the name of the instance of Report Server.

1. You can edit the information.

2. Click Connect to connect to the specified Report Server instance.

Configuring SQL Server Report Server 57


Figure 25 Reporting Services Configuration Connection - SQL Server 2008

Figure 26 Reporting Services Configuration Connection - SQL Server 2008 R2

Step 2: Specify the service accountMicrosoft recommends changing the Reporting Services service account through SQL Server Reporting Services Configuration Manager, not through the service console.

To specify the service account:

1. In the left pane of the Reporting Services Configuration Manager window, click Service Account.

2. Select the Use built-in account option.

3. Select Network Service from the dropdown list.



Figure 27 Service Account - Use built-in account

4. Click Apply.

Step 3: Specify the Web Service URLTo specify the Web Service URL:

1. In the left pane of the Reporting Services Configuration Manager window, click Web Service URL.

2. The right pane displays the default values for the Report Server Web Service.

Leave the default settings.



Figure 28 Web Service URL

3. Click Apply.

The Results pane indicates the progress of URL creation.

IMPORTANT!Make a note of the Report Server Web Service URL shown at the bottom of the right pane. You need this URL when you install EMC SourceOne reports and Discovery Manager reports later.



Step 4: Specify information about the Reporting Server databaseSQL Server Reporting Server uses its own report database for internal processing of reports and other catalog information. This is not a EMC SourceOne database.

To specify information about the Reporting Server database:

1. In the left pane, click Database.

2. In the right pane, click Change Database.

Figure 29 Report Server Database

The Change Database dialog box opens.

3. Continue to each of the following steps, in the order given:

• “Step 4 A: Change Database - Action page” on page 61

• “Step 4 B: Change Database - Database Server page” on page 61

• “Step 4 C: Change Database - Database page” on page 62

• “Step 4 D: Change Database - Credentials page” on page 63

• “Step 4 E: Change Database - Summary page” on page 64

• “Step 4 F: Change Database - Progress and Finish page” on page 65



Step 4 A: Change Database - Action page1. On the Action page of the Change Database dialog box, select the

Create a new report server database option.

Figure 30 Change Database - Action

2. Click Next.

Step 4 B: Change Database - Database Server pageOn the Database Server page of the Change Database dialog box:

1. In the Server Name field, specify the name of the server running SQL Server Database Engine.

2. In the Authentication Type field, select Current user - Integrated Security.

The Username field displays the name of the account that has permission to connect to the SQL Server Database Engine. You specified this account when you installed the Database Engine.

3. Click Test Connection to verify that the specified account can connect to the Database Engine.



Figure 31 Change Database - Database Server

4. Click Next.

Step 4 C: Change Database - Database pageOn the Database page of the Change Database dialog box:

1. Specify the name of the Report Server database. The default is ReportServer.

2. In the Language field, select the appropriate language.

The language you specify for the reports database affects the names of roles and other internal features that an administrator sees when managing the database. It does not affect EMC SourceOne reports.

3. For Report Server Mode, select the Native Mode option.

4. Click Next.



Figure 32 Change Database - Database

Step 4 D: Change Database - Credentials page1. On the Credentials page of the Change Database dialog box, in

the Authentication Type field, select Service Credentials (default).

This is the account that the Report Server will use to connect to the Report Server database, using the same credentials as the Reporting Service.

The User name and Password fields display the credentials of the service account for Reporting Services that you specified during installation.

Note: The Windows Credentials option connects using the specified credentials for a particular Windows user. Select this option if the default Service Credentials option is not appropriate. The SQL Server Credentials option is not recommended.

2. Click Next.



Figure 33 Change Database - Credentials

Step 4 E: Change Database - Summary pageThe Summary page of the Change Database dialog box lists the configuration information that you supplied.

1. Verify that the information is correct. If it is not correct, edit the information on the appropriate page of the Change Database wizard.

2. Click Next.

Figure 34 Change Database - Summary



Step 4 F: Change Database - Progress and Finish pageThe Progress and Finish page of the Change Database dialog box indicates the progress of the configuration, and then indicates that the installation completed successfully.

Click Complete.

Step 5: Specify the Report Manager URLThe Report Manager URL will be used to access the EMC SourceOne reports and Discovery Manager reports.

To specify the Report Manager URL:

1. In the left pane of the Reporting Services Configuration Manager window, click Report Manager URL.

2. The right panel displays the URL to access Report Manager, based on information you supplied:

• You can edit the default value for the virtual directory.

• To edit other parameters, click Advanced.

3. Click Apply.

The Results pane indicates the progress of URL creation.



Figure 35 Report Manager URL

IMPORTANT!Make a note of the URL shown in the right pane. This is the URL that you will use to access EMC SourceOne reports and Discovery Manager reports.

4. Click the URL to verify that you can access the Report Manager home page.

Figure 36 Report Manager home page



Step 6: Use defaults for Email SettingsUse the defaults for email settings:

1. In the left pane of the Reporting Services Configuration Manager window, click Email Settings.

2. In the right pane, leave the default settings for email.

Figure 37 Email Settings

Step 7: Use defaults for Execution AccountTo use the defaults for Execution Account:

1. In the left pane of the Reporting Services Configuration Manager window, click Execution Account.

2. In the right pane, leave the default settings for the execution account.



Figure 38 Execution Account

Step 8: Specify backup information for the encryption keyTo specify backup information for Reporting Services encryption key:

1. In the left pane of the Reporting Services Configuration Manager window, click Encryption Keys.

2. In the right pane, click Backup.



Figure 39 Encryption Keys

3. In the Backup Encryption Key dialog box, specify the security password and file to backup your Report Server encryption key.

a. In the File Location field, either:

– Type a new pathname– Click Browse and select an existing encryption key file.

b. In the Password field, type the password for the encryption key.

c. In the Confirm Password field, retype the password.

The encryption file and password are used to save the encrypted information (such as credentials) stored in Report Server. This information is required in case Report Server becomes corrupt and needs to be restored with a re-install.

4. Click OK to close the Backup Encryption Key dialog box.



Figure 40 Backup Encryption Key

Step 9: Use defaults for Scale-out DeploymentUse the defaults for Scale-out Deployment:

1. In the left pane of the Reporting Services Configuration Manager window, click Scale-out Deployment.

2. The right pane displays information about the Report Server.

3. Click Exit to close the Reporting Services Configuration Manager window.

Figure 41 Scale-out Deployment

Verifying installation of SQL Server Report Server 71


Verifying installation of SQL Server Report ServerUse one of the following methods to verify the installation of SQL Server Report Server:

◆ In Reporting Services Configuration Manager, click the URL link described in “Step 5: Specify the Report Manager URL” on page 65.

◆ Outside of Reporting Services Configuration Manager, follow these steps on the Report Server. Repeat the procedure on a client computer.

1. Start Internet Explorer.

2. Type the Report Manager URL. (This is the URL shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.)

Note: It may take a few minutes to access the URL, and it may appear that the access operation has hung. SQL Server Reporting Services flushes its cache if it is inactive for 20 minutes.

3. Verify that you see the SQL Server Reporting Services Home page.

You have completed installing and configuring SQL Server Reporting Services.



Installing EMC SourceOne reportsThis section describes the prerequisites and procedures for installing EMC SourceOne reports.

PrerequisitesEnsure the following prerequisites are completed:

◆ Install and configure SQL Server Reporting Services, as described earlier in this chapter.

◆ Verify that the SQL Server Reporting Services web service is ready by browsing to the Web Service URL. (This is the URL shown on the Web Service URL page of SQL Server Reporting Services Configuration Manager.)

Note: If you attempt to install EMC SourceOne reports before this web service is ready, then the installation may time out.

◆ The SourceOne Reports setup program includes reports for EMC SourceOne for Microsoft SharePoint.

Note: If EMC SourceOne for Microsoft SharePoint is not installed on your SourceOne system, then the SourceOne Reports setup program will skip the installation of the SharePoint reports and will not report an error.

◆ The SourceOne Reports setup program includes reports for EMC SourceOne for File Systems.

Note: If EMC SourceOne for File Systems is not installed on your SourceOne system, then the SourceOne Reports setup program will skip the installation of the Files reports and will not report an error.

Installing EMC SourceOne reports 73


ProcedureIn the EMC SourceOne Email Management kit, the SourceOne Reports setup program (ES1_Reports_Setup.bat) is located in:

ES1_CDRom\Setup\Reporting\EMC SourceOne

To install EMC SourceOne reports, on the SQL Server 2008, 2008 R2, or 2012 Report Server:

1. Log on with local administrator privileges on the computer.

2. Open a command window.

3. Run the following command:

ES1_Reports_Setup.bat

4. At the following prompt:

Specify SQL Server for Activity database <default:localhost>:

a. Specify the SQL Server that hosts the EMC SourceOne Activity database.

b. Specify the IP address or the server name, or press Enter to accept the default (localhost).

5. At the following prompt, specify the name of the EMC SourceOne Activity database.

Specify Activity Database Name:

6. At the following prompt, specify the URL of the Report Server Web Service.

Specify Report Server Web Service URL:

Note:

• It is not necessary to include the port number.

• This URL must be the same one that you configured on the Web Service URL page in Reporting Services Configuration Manager.



Figure 42 Example - Web Service URL

Note: Do not specify the Report Manager URL.

7. At the View log file? <Y/N default:N> prompt, do one of the following steps:

• If you want to view the log file, press Y.

• If you do not want to view the log file, press N, or press Enter to accept the default (N).

Figure 43 Running ES1_Reports_Setup.bat

If the installation is successful, then you see messages confirming the installation of each report.

If an error occurs during installation, then you see an error message. The following example shows the error message displayed when you type an incorrect URL.

Installing EMC SourceOne reports 75


Figure 44 404 error due to incorrect URL

Verify report installationTo verify that the reports were installed:




3. Verify that the SQL Server Reporting Services home page displays the EMC SourceOne folder.

Figure 45 EMC SourceOne folder

4. Click the EMC SourceOne folder to open it.



5. Verify that the folder contains the following subfolders:

• Configuration Reports

• Search Audit Reports

• System Reports

Figure 46 EMC SourceOne reports subfolders

Installing EMC Discovery Manager reports 77


Installing EMC Discovery Manager reportsThis section describes the prerequisites and procedures for installing EMC Discovery Manager reports.

PrerequisitesEnsure the following prerequisites are completed:

◆ Install and configure SQL Server Reporting Services, as described earlier in this chapter.

◆ Verify that the SQL Server Reporting Services web service is ready by browsing to the Web Service URL. (This is the URL shown on the Web Service URL page of SQL Server Reporting Services Configuration Manager.)

Note: If you attempt to install EMC Discovery Manager reports before this web service is ready, then the installation may time out.

ProcedureIn the EMC SourceOne Email Management kit, the Discovery Manager Reports setup program (ES1_DM_Reports_Setup.bat) is located in:

ES1_CDRom\Setup\Reporting\Discovery Manager

To install EMC Discovery Manager reports, on the SQL Server 2008, 2008 R2, or 2012 Report Server:

1. Log on with local administrator privileges on the computer.

2. Open a command window.

3. Run ES1_DM_Reports_Setup.bat.

4. At the following prompt, specify the SQL Server that hosts the EMC Discovery Manager database:

Specify SQL Server for Discovery Manager database <default:localhost>:

Specify the IP address or the server name, or press Enter to accept the default (localhost).



5. At the following prompt, specify the name of the EMC Discovery Manager database.

Specify Discovery Manager Database Name:

6. At the following prompt, specify the URL of the Report Server Web Service. It is not necessary to include the port number.

Specify Report Server Web Service URL:

This URL must be the same one that you configured on the Web Service URL page in Reporting Services Configuration Manager.

Figure 47 Example - Web Service URL

Note: Do not specify the Report Manager URL.

7. At the View log file? <Y/N default:N> prompt, do one of the following steps:

• If you want to view the log file, press Y.

• If you do not want to view the log file, press N, or press Enter to accept the default (N).

Installing EMC Discovery Manager reports 79


Figure 48 Running ES1_DM_Reports_Setup.bat

If the installation is successful, then you see messages confirming the installation of each report.

If an error occurs during installation, then you see an error message.

Verify report installationTo verify that the reports were installed:




3. Verify that the SQL Server Reporting Services home page displays the EMC Discovery Manager folder.

Figure 49 EMC Discovery Manager folder



If you installed the EMC SourceOne reports previously, then you also see the EMC SourceOne folder.

4. Click the Discovery Manager folder to open it.

5. Verify that the folder contains the Search Audit Reports subfolder.

Figure 50 Discovery Manager reports subfolder

Controlling access to EMC SourceOne and Discovery Manager reports 81


Controlling access to EMC SourceOne and Discovery Manager reports

After you install EMC SourceOne reports and Discovery Manager reports, you must set permissions for users to access those reports.

The examples in this section describe common scenarios, and assume:

◆ For EMC SourceOne reports:

• EMC SourceOne Email Management and EMC SourceOne reports are installed.

• SQL Server Reporting Services are installed on the same computer that hosts the EMC SourceOne Activity database.

◆ For Discovery Manager reports:

• EMC SourceOne Email Management, EMC SourceOne Discovery Manager, and Discovery Manager reports are installed.

• SQL Server Reporting Services are installed on the same computer that hosts the EMC SourceOne Discovery Manager database.

Roles in Reporting ServicesIn SQL Server Reporting Services, you can assign groups or users to different roles to control access to reports. For example, the Content Manager role could include administrator users who are able to view and customize reports, and the Browser role could include additional users who can only view reports.

Most security access can be managed through the Reporting Server web portal without requiring SQL Server administration privileges. For example, if you give a user the Content Manager role for Discovery Manager reports, that user can manage the report security directly through the Reports portal.

You can remove local administrator privileges from users who run or view the reports. However, those users can change report security and add themselves as report viewers. Microsoft does this by design to prevent lock-out situations.



The Content Manager role and the Browser role have pre-defined permissions in Reporting Services. If these built-in roles are not appropriate, then you can create custom roles in SQL Server Management Studio. For example, if you want administrators to set up reports without being able to view them, then you could create a role that grants all permissions except for View Report.

To customize roles further, refer to Microsoft documentation.

Requirements for users and groups

For Content Manager roleAssigning the EMC SourceOne security group to the Content Manager role bypasses the need to set up additional permissions in Active Directory and SQL for report administration.

Note: The EMC SourceOne security logins (SourceOne security group, SourceOne installation account, and SourceOne Admins group) have db_datareader and db_datawriter permissions on the SourceOne databases and the Discovery Manager database, as described in "Configure SQL permissions" in the EMC SourceOne Email Management Installation Guide and the EMC SourceOne Discovery Manager Installation and Administration Guide.

For Browser roleFor users who will have read-only access to reports:

1. Create a group in Active Directory. For example, EMC SourceOne Report Users.

2. Add appropriate users to the group.

3. To view reports, members of this new group also need access to the appropriate database.

Using SQL Server Management Studio:

a. Add the group as a login.

b. Under the appropriate EMC SourceOne database, assign the group the permissions as described in the following table.

Controlling access to EMC SourceOne and Discovery Manager reports 83


Assigning users to rolesYou can specify security settings for all EMC SourceOne reports, for all Discovery Manager reports, for all reports in a folder, or for individual reports.

To specify security settings, you must:

◆ Be logged in as administrator

or

◆ Be a user who already has the Content Manager role.

To navigate to security settings and assign users to roles:

1. Using Internet Explorer, navigate to the SQL Server Reporting Services Home page.

Use the URL shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.

Table 4 Database permissions for Browser role

To view these reports Assign database roleAssign explicit database permissions

Assign schema/table-level permissions

EMC SourceOne reports db_datareader on the SourceOne Activity database

Connect and Execute on the SourceOne Activity database

Not applicable

EMC Discovery Manager reports

Not applicable

Note: For security reasons, do not grant db_datareader permission on the Discovery Manager database to read-only users of Discovery Manager reports.

Connect and Execute on the Discovery Manager database

SELECT permission on the AuditSchema schema in the Discovery Manager database



2. Navigate to the Security tab of the folder or report for which you want to set access.

For example, to specify security settings for all EMC SourceOne reports, do one of the following steps:

• In SQL Server 2008, open the EMC SourceOne folder, click the Properties tab, then click Security.

• In SQL Server 2008 R2, select Manage from the EMC SourceOne folder’s dropdown menu, then click Security.

3. On the Security tab, click New Role Assignment.

4. Do one of the following steps:

• To specify users who can view and manage reports:

a. In the Group or user name field, specify your EMC SourceOne security group.

b. Select the Content Manager role.

• To specify users who have read-only access to reports:

a. In the Group or user name field, specify the name of the report users group that you created in Active Directory.

b. Select the Browser role.

5. Click OK.

Authenticating with the EMC SourceOne Activity database 85


Authenticating with the EMC SourceOne Activity databaseIf your Reporting Services are on a different computer than the one that hosts EMC SourceOne Activity database, when you view reports, you may experience errors relating to authentication with the Activity data source. This is the result of Windows Integrated Security, which can only pass credentials across one computer unless Kerberos is enabled. If this problem occurs, then do one of the following steps:

◆ Configure your network to use Kerberos.

◆ Configure the Activity data source to use Credentials supplied by the user running the report instead of Windows Authentication. When running reports, users will be prompted for valid credentials to connect to the SQL database.

To change connection credentials for the Activity data source:

1. On the Home page of SQL Server Reporting Services, open the EMC SourceOne folder.

2. Click Show Details (SQL Server 2008) or Detail View (SQL Server 2008 R2).

Figure 51 EMC SourceOne folder - Details view

3. Open the Data Sources folder.

4. Click the dsES1Activity link.



Figure 52 Data Sources folder

5. On the Properties page:

a. Select Credentials supplied by the user running the report.

b. Select the Use as Windows credentials when connecting to the data source checkbox.

Figure 53 Properties page - dsES1Activity data source

6. Click Apply.

Authenticating with the EMC Discovery Manager database 87


Authenticating with the EMC Discovery Manager databaseIf your Reporting Services are on a different computer than the one that hosts EMC Discovery Manager database, when you view Discovery Manager reports, you may experience errors relating to authentication with the Discovery Manager data source. This is the result of Windows Integrated Security, which can only pass credentials across one computer unless Kerberos is enabled.

If this problem occurs, then do one of the following steps:

◆ Configure your network to use Kerberos.

◆ Configure the Discovery Manager data source to use Credentials supplied by the user running the report instead of Windows Authentication.

When running reports, users will be prompted for valid credentials to connect to the SQL database.

To change connection credentials for the Discovery Manager data source:

1. On the Home page of SQL Server Reporting Services, open the Discovery Manager folder.

2. Click Show Details (SQL Server 2008) or Detail View (SQL Server 2008 R2).

3. Open the Data Sources folder.

4. Click the dsES1DM link.

5. On the Properties page:

a. Select Credentials supplied by the user running the report.

b. Select the Use as Windows credentials when connecting to the data source checkbox.

6. Click Apply.



Configuring Internet Explorer for all EMC reportsAfter installing EMC SourceOne reports and Discovery Manager reports, add the URL of the SQL Server Reporting Services web site to the Local Intranet Zone in Internet Explorer. This URL is shown on the Report Manager URL page of SQL Server Reporting Services Configuration Manager.

To configure Internet Explorer settings for client computers accessing the EMC SourceOne Reports or Discovery Manager Reports URL:

1. Open Internet Explorer.

2. Select Tools > Internet Options and select the Security tab.

3. Click Local intranet and select Custom Level.

4. Scroll to the bottom of the Settings pane.

5. In the User Authentication > Logon section, ensure that Automatic logon only in Intranet zone is selected.

6. Click OK to return to the Security tab.

7. Click Sites.

8. Click Advanced.

9. Add the URL of the SQL Server Reporting Services web site.

When this configuration is complete, the Internet Security Properties icon displayed in the lower right side of the browser should indicate that the site is in the local intranet.

Maintaining the installation 89


Maintaining the installationThis section provides information on maintaining installation of the components described in this chapter.

UpgradeRefer to the product release notes for detailed instructions on upgrading EMC SourceOne reports and Discovery Manager reports.

Uninstall reportsTo uninstall EMC SourceOne reports and Discovery Manager reports, including all customizations:

1. You must have System Administrator privileges for SQL Server Reporting Services.

2. In Internet Explorer, type the Report Manager URL for your SQL Server Reporting Services.

The SQL Server Reporting Services home page opens.

3. Click Show Details on the right side of the toolbar.

The home page lists the Data Sources, the EMC SourceOne folders, and the EMC Discovery Manager folder.

4. Select the checkboxes for both the Data Sources, the EMC SourceOne folders, and the Discovery Manager folder.

5. Click Delete on the toolbar.



Running EMC SourceOne Reports 91

6

This chapter describes how to access and view EMC SourceOne reports.

Note: To export and print reports, refer to “Working with reports” on page 30.

This chapter includes the following topics:

◆ Accessing EMC SourceOne reports................................................. 92◆ Mapped Folder Permissions Audit report ..................................... 97◆ Mapped Folder Effective Permissions report .............................. 101◆ Specifying parameters for Search Audit reports (Search).......... 104◆ Consideration for Search Audit Reports ...................................... 106◆ Search Activity report (Search) ...................................................... 108◆ Search Copy report (Search) ............................................................ 111◆ Search Delete report (Search) ......................................................... 114◆ Search Restore report (Search) ....................................................... 117◆ File Search Restore report (Search) ................................................ 120◆ Documents Copied report (Search) ............................................... 124◆ Documents Deleted report (Search) .............................................. 128◆ Documents Restored report (Search) ............................................ 132◆ Files Restored report (Search) ........................................................ 136◆ Data Source Processing report ....................................................... 144◆ Email Management Activity dashboard....................................... 158◆ Search Activity dashboard.............................................................. 173◆ SharePoint Management Activity Dashboard ............................. 180◆ Files Management Activity Dashboard ........................................ 193

Running EMC SourceOne Reports



Accessing EMC SourceOne reportsTo access EMC SourceOne reports:

1. In Internet Explorer 7.0 or higher, enter the URL for your SQL Server 2008, 2008 R2, or 2012 Reporting Services, as provided by your system administrator.

The SQL Server Reporting Services home page opens. It displays the EMC SourceOne folder.

Figure 54 EMC SourceOne folder on SQL Server 2008 Reporting Services home page

If EMC Discovery Manager reports are installed, then the EMC Discovery Manager folder is also displayed.

2. Click the EMC SourceOne folder to open it.

The EMC SourceOne page displays the following subfolders:

• Configuration Reports

• Search Audit Reports

• System Reports

Figure 55 EMC SourceOne reports page

Accessing EMC SourceOne reports 93


3. To access a report, open the appropriate subfolder.

• The Configuration Reports folder contains the reports described in the following table.

Figure 56 Configuration Reports folder

• The Search Audit Reports folder contains the reports described in the following table.

Figure 57 Search Audit Reports folder on SQL Server 2008 R2 Reporting Services

Table 5 Reports in Configuration Reports folder

Report Description

“Mapped Folder Effective Permissions report” on page 101

Shows the EMC SourceOne mapped folder permissions that were in effect for a specific user on a specific date.

“Mapped Folder Permissions Audit report” on page 97

Shows when mapped folder permissions changed for specific users during a specific period or date range, and who changed the permissions.



• The System Reports folder contains the reports described in the following table.

Table 6 Reports in Search Audit Reports folder

Report Description

“File Search Restore report (Search)” on page 120

Lists the File Restore operations that were performed in EMC SourceOne Search

“Documents Copied report (Search)” on page 124

Lists the documents that were copied to mapped folders in EMC SourceOne Search using the Copy To operation.

“Documents Deleted report (Search)” on page 128

Lists the documents that were deleted in EMC SourceOne Search by using the Delete operation.

“Documents Restored report (Search)” on page 132

Lists the documents that were restored in EMC SourceOne Search by using the Restore operation.

“Files Restored report (Search)” on page 136

Lists the files that were restored in EMC SourceOne Search by using the File Restore operation.

“Documents Viewed report (Search)” on page 140

Lists the documents that were viewed or previewed in EMC SourceOne Search.

“Search Activity report (Search)” on page 108

Lists the searches that were performed in EMC SourceOne Search.

“Search Copy report (Search)” on page 111

Lists the Copy To operations that were performed in EMC SourceOne Search.

“Search Delete report (Search)” on page 114

Lists the Delete operations that were performed in EMC SourceOne Search.

“Search Restore report (Search)” on page 117

Lists the Restore operations that were performed in EMC SourceOne Search.

Accessing EMC SourceOne reports 95


Figure 58 System Reports folder

Table 7 Reports in System Reports folder

Report Description

“Data Source Processing report” on page 144

Displays statistics about the processing of:• mailboxes and PSTs for specific SourceOne email

management activities for the specified period• items for SourceOne SharePoint Archive and

SharePoint Online Archive activities for the specified period (available if EMC SourceOne for Microsoft SharePoint is installed on your SourceOne system)

• files for Files activities for the specified periods (available if EMC SourceOne for File Systems is installed on your SourceOne system)

“Email Management Activity dashboard” on page 158

Displays statistics for a specific type of email management activity and specific period.

Note: This dashboard shows email processing metrics from the front-end SourceOne Activity database for the most commonly-used email management activities, not email archiving metrics from the back-end archive server.



“Search Activity dashboard” on page 173

Displays statistics about the following EMC SourceOne Search and Discovery Manager jobs for the specified period of time:• EMC SourceOne Search - search, copy, and

restore jobs• Discovery Manager - search, copy, and export jobs

“SharePoint Management Activity Dashboard” on page 180

Available if EMC SourceOne for Microsoft SharePoint is installed on your SourceOne system.Displays statistics for the following SourceOne SharePoint activities:• SharePoint Archive• SharePoint Online Archive

Note: This dashboard shows processing metrics from the front-end SourceOne Activity database, not archiving metrics from the back-end archive server.

“Files Management Activity Dashboard” on page 193

Available if EMC SourceOne for File Systems is installed on your SourceOne system.Displays statistics for the following SourceOne Files activities:• File Archive - Historical• File Delete - Historical• File Removal

Note: This dashboard shows processing metrics from the front-end SourceOne Activity database, not archiving metrics from the back-end archive server.

Table 7 Reports in System Reports folder (continued)

Report Description

Mapped Folder Permissions Audit report 97


Mapped Folder Permissions Audit reportThe Mapped Folder Permissions Audit report shows when mapped folder permissions changed for specific users during a specific period or date range, and who changed the permissions.

Prerequisite: Mapped Folder Permissions Audit reportTo configure permissions on mapped folders, refer to the EMC SourceOne Email Management Administration Guide, "Configuring Mapped Folders."

Procedure: Mapped Folder Permissions Audit reportTo run the Mapped Folder Permissions Audit report:

1. Access the Mapped Folder Permissions Audit report. For example, Home > EMC SourceOne > Configuration Reports > Mapped Folder Permissions Audit Report, as described in “Accessing EMC SourceOne reports” on page 92.

2. Enter report parameters, as described in “Specifying parameters for Mapped Folder Permissions Audit report” on page 97.

3. Click View Report to generate the report based on your parameters.

4. To interpret the report, refer to “Understanding the Mapped Folder Permissions Audit report” on page 99.

Specifying parameters for Mapped Folder Permissions Audit reportEnter report parameters, as described in the following table.

To specify a date, do one of the following steps:

◆ Use the Begin Date field or the End Date field to specify an open-ended date range.

◆ Use the Begin Date field and the End Date field to specify a bounded date range.

◆ Use the Period field to specify a span of time.



Figure 59 Parameters for Mapped Folder Permissions Audit report

Table 8 Parameters for Mapped Folder Permissions Audit report


Begin Date Do one of the following steps:• If you do not want to specify a Begin Date, select the NULL

checkbox (default).• To specify a Begin Date, clear the NULL checkbox, click the

calendar icon, then select a date. The Period field defaults to Not Specified.

End Date Do one of the following steps:• If you do not want to specify an End Date, select the NULL

checkbox (default).• To specify an End Date, clear the NULL checkbox, click the


Period To specify a period of time, select an option in the Period field:• All Dates• Today• Yesterday• Last 24 Hours• This Week• Last Week• This Month• Last Month• This Quarter• Last Quarter• This Year• Last Year• Not Specified - Do not select this option; it will not return any

results. It is displayed automatically if you specify a Begin Date or an End Date.

Mapped Folder Permissions Audit report 99


Understanding the Mapped Folder Permissions Audit reportThis section describes the information displayed in the Mapped Folder Permissions Audit report.

Times are based on the time zone in which the Activity database SQL Server resides, not the time zone of the client computer.

Figure 60 Example - Mapped Folder Permissions Audit report

For information about the Report Configuration section, refer to “Display features in EMC SourceOne and Discovery Manager reports” on page 30.

Modified By Select a user who modified the permissions.

Mapped Folder Select a mapped folder. The list shows active mapped folders, not mapped folders that have been deleted.

Folder User Select the user whose permissions you want to view. Names are listed in display name format or LDAP format, depending on how they were specified in the Mapped Folder configuration wizard.

Table 8 Parameters for Mapped Folder Permissions Audit report (continued)




Body of reportRefer to following table.

Table 9 Body of Mapped Folder Permissions Audit report

Column Description

Date The date on which the search was performed. By default, dates are sorted in descending order (newest dates first).A blue value indicates that you can click on it to drill through to the associated Mapped Folder Effective Permissions report. Refer to “Understanding the Mapped Folder Effective Permissions report” on page 102.

Mapped Folder The name of the EMC SourceOne mapped folder.

Modified By The name of the user who changed the folder permissions.

Action The type of change:• Added = Folder permissions were added to a user.• Removed = Folder permissions were removed from a user.

Folder User The name of the user whose folder permissions were changed.

Permission The name of the folder permission added to or removed from the user.

Mapped Folder Effective Permissions report 101


Mapped Folder Effective Permissions reportThe Mapped Folder Effective Permissions report shows the EMC SourceOne mapped folder permissions that were in effect for a specific user on a specific date.

Prerequisite: Mapped Folder Effective Permissions reportTo configure permissions on mapped folders, refer to the EMC SourceOne Email Management Administration Guide, "Configuring Mapped Folders."

Procedure: Mapped Folder Effective Permissions reportTo run the Mapped Folder Effective Permissions report:

1. Access the Mapped Folder Effective Permissions report. For example: Home > EMC SourceOne > Configuration Reports > Mapped Folder Effective Permissions Report, as described in “Accessing EMC SourceOne reports” on page 92.

2. Enter report parameters, as described in “Specifying parameters for Mapped Folder Effective Permissions report” on page 101


4. To interpret the report, refer to “Understanding the Mapped Folder Effective Permissions report” on page 102.

Specifying parameters for Mapped Folder Effective Permissions reportEnter report parameters, as described in the following table.

Figure 61 Parameters for Mapped Folder Effective Permissions report



Understanding the Mapped Folder Effective Permissions reportThis section describes the information displayed in the Mapped Folder Effective Permissions report.


Figure 62 Example - Mapped Folder Effective Permissions report


Table 10 Parameters for Mapped Folder Effective Permissions report


Date Click the calendar icon, then select the date for which you want to view permissions.

Folder User Select the user whose permissions you want to view. Names are listed in display name format or LDAP format, depending on how they were specified in the Mapped Folder configuration wizard.

Mapped Folder Select a mapped folder. The list shows active mapped folders, not mapped folders that have been deleted.

Mapped Folder Effective Permissions report 103



Table 11 Body of Mapped Folder Effective Permissions report

Column Description

Mapped Folder The name of the EMC SourceOne mapped folder.

Folder User The name of the user.A blue value indicates that you can click on it to drill through to the associated Mapped Folder Permissions Audit report. Refer to “Understanding the Mapped Folder Permissions Audit report” on page 99.

Effective Permissions on <date> A green checkmark indicates the user had that folder permission on the specified date.

Last Changed The date and time on which the permissions were last changed before the effective permission date for the user on that folder.



Specifying parameters for Search Audit reports (Search)To specify parameters for any Search Audit report in the EMC SourceOne > Search Audit Reports folder:

1. Access the report, as described in “Accessing EMC SourceOne reports” on page 92.

Figure 63 Example - default parameters for Search Activity (Search) report

2. Enter report parameters, as described in the following table.


• Use the Begin Date field or the End Date field to specify an open-ended date range.

• Use the Begin Date field and the End Date field to specify a bounded date range.

• Use the Period field to specify a span of time.

Table 12 Search Activity (Search) report parameters








Specifying parameters for Search Audit reports (Search) 105


Period To specify a period of time, select an option in the Period field:• All Dates• Today• Yesterday• Last 24 Hours• This Week• Last Week• This Month• Last Month• This Quarter• Last Quarter• This Year• Last Year• Not Specified - Do not select this option; it will not return any


User To specify the search user, select an option in the User field:• All (default)• The name of a search userThe User field lists the names of users performed an audited search operation. If a user has not been audited, then his name does not appear in the list.

Expand All Groups Select one of the Expand All Groups options:• True - Expands all rows and sections to display details.• False (default) - Does not expand all rows and sections.

Table 12 Search Activity (Search) report parameters (continued)




Consideration for Search Audit ReportsDue to single-instancing, a single file in the SourceOne archive may have been archived from multiple different locations on one or more file servers. This means that when a file is restored, it can potentially be written to more than one destination directory.

When a file restore is initiated via web search, the user can choose whether to restore to:

◆ All locations

◆ A filtered subset of locations

◆ An entirely new location

For end-user restore, the list of locations being restored to will also be reduced if the logged in user does not have permissions to all locations.

When a file is restored, the count of items restored and failed in the File Restore Search Report is based on the number of files (search hits) being restored. For the Files Restored report, the Restore Operation Details section will further break down each location processed for each of those files. This takes the form of destination/status pairs.

For each destination, which will appear as a UNC path, the status may be one of the following values:

◆ Restored — the file was successfully restored to this location

◆ Failed — the file could not be restored to this location

◆ Skipped — the job did not attempt to restore the file to this location.

Consideration for Search Audit Reports 107


Examples of reasons a file might be skipped include the following:

◆ A newer version of the file already exists in the location, and the overwrite option was not enabled

◆ A path filter was specified, and the location did not match that filter

◆ The user carrying out the restore does not have file system permissions to this location

Note: If a file fails to be restored to a particular location, no more locations will be processed. In some rare circumstances, no locations may be processed for a particular file. In those cases, there will be a single Destination set to ""n/a". One example of this would be when a restore filter is specified for which no locations match.



Search Activity report (Search)The Search Activity report lists the audited searches that were performed in EMC SourceOne Search.

Prerequisite: Search Activity report (Search)Before you can run a Search Activity report for audited users, you must enable the Audit search activities configuration setting and specify the audited users. To configure auditing, refer to in the EMC SourceOne Email Management Administration Guide, "Configuring Applications and Web Services" > “Auditing Search operations.”

Searches performed using the Administrator search type are always audited.

Procedure: Search Activity report (Search)To run the Search Activity report:

1. Access the Search Activity report (Home > EMC SourceOne > Search Audit Reports > Search Activity Report), as described in “Accessing EMC SourceOne reports” on page 92.

2. Enter report parameters, as described in “Specifying parameters for Search Audit reports (Search)” on page 104.


4. To interpret the report, refer to “Understanding the Search Activity report (Search)” on page 108.

Understanding the Search Activity report (Search)This section describes the information displayed in the Search Activity report.


Search Activity report (Search) 109


Figure 64 Example - Search Activity report


Body of reportThe first row shows totals for some columns.

Table 13 Body of Search Activity report

Column Description

Date The date on which the search was performed.

User The display name of the search user who performed the search.

Search Role The role of the search user, as described in “Search roles for SourceOne Search reports” on page 23.

Folders The names of the EMC SourceOne mapped folders that were searched.

Search Terms The search criteria.If the search user did not specify criteria, then the Search Terms column displays Date <= 2038-01-01

Results The number of results returned by the search.

Viewed The number of items in search results that were viewed by the user.A blue number indicates that you can click on it to drill through to the associated Documents Viewed report. Refer to “Understanding the Documents Viewed report” on page 141.



Search Operation DetailsTo see details for a search operation, expand the row by clicking the plus sign (+) next to the date.

Table 14 Search Operation Details in Search Activity report

Column Description

Date The date on which the search was performed.

User The name of the search user who performed the search.


Results The number of results returned by the search.

Viewed Items The number of items in search results that were viewed by the user.A blue number indicates that you can click on it to drill through to the associated Documents Viewed report. Refer to “Understanding the Documents Viewed report” on page 141.

Folders Searched The names of the EMC SourceOne mapped folders that were searched.

Search Terms The search criteria.

JobID The ID of the job associated with the search operation.

Search Copy report (Search) 111


Search Copy report (Search)The Search Activity report lists the audited Copy To operations that were performed in EMC SourceOne Search.

Prerequisite: Search Copy reportThe Copy To operation in Search is available only for the Administrator search type.

Copy To activities are always audited for the Administrator search type.

To be able to drill through to a Documents Copied report from a Search Copy report, you must enable the Capture document details setting associated with the Audit copy to folders activities setting for Administrators.

To configure auditing, refer to the EMC SourceOne Email Management Administration Guide, "Configuring Applications and Web Services" > “Auditing Search operations.”

Procedure: Search Copy reportTo run the Search Copy report:

1. Access the Search Copy report. For example: Home > EMC SourceOne > Search Audit Reports > Search Copy Report, as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Search Copy report” on page 112.



Understanding the Search Copy reportThis section describes the information displayed in the Search Copy report.


Figure 65 Example - Search Copy report



Table 15 Body of Search Copy report

Column Description

Date The date on which the Copy To operation was performed.

User The display name of the user who performed the Copy To operation.


Destination Folder The name of the EMC SourceOne mapped folder to which documents were copied.

Search Copy report (Search) 113


Copy Operation DetailsTo see details for a copy operation, expand the row by clicking the plus sign (+) next to the date.

Copied The number of documents that were copied successfully.

Failed The number of documents that failed to copy. Refer to “Copy To operations and Restore operations” on page 27 for more information.

Audited The total number of documents that were audited in the Copy To operation, including documents that copied successfully and documents that failed to copy.A blue number indicates that you can click on it to drill through to the associated Documents Copied report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Copied report” on page 125.

Table 15 Body of Search Copy report (continued)

Column Description

Table 16 Copy Operation Details in Search Copy report

Column Description

Date The date on which the Copy To operation was performed.

User The name of the user who performed the Copy To operation.


Copied Items The number of documents that were copied successfully.

Failed Items The number of documents that failed to copy. Refer to “Copy To operations and Restore operations” on page 27 for more information.

Audited Items The total number of documents that were audited in the Copy To operation, including documents that copied successfully and documents that failed to copy.A blue number indicates that you can click on it to drill through to the associated Documents Copied report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Copied report” on page 125.

Destination Folder The name of the EMC SourceOne mapped folder to which documents were copied.

Job ID The ID of the job associated with the Copy To operation.



Search Delete report (Search)The Search Delete report lists the audited Delete operations that were performed in EMC SourceOne Search.

Prerequisite: Search Delete reportDelete operations are always audited for the Administrator search type.

Before you can run a Search Delete report for audited users, you must enable the Audit delete activities setting and specify the audited users.

To be able to drill through to a Documents Deleted report from a Search Delete report, you must enable the Capture document details setting associated with the Audit delete activities setting.


Procedure: Search Delete reportTo run the Search Delete report:

1. Access the Search Activity report. For example, Home > EMC SourceOne > Search Audit Reports > Search Delete Report, as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Search Delete report” on page 115.

Search Delete report (Search) 115


Understanding the Search Delete reportThis section describes the information displayed in the Search Delete report.


Figure 66 Example - Search Delete report



Table 17 Body of Search Delete report

Column Description

Date The date on which the Delete operation was performed.

User The display name of the user who performed the Delete operation.




Delete Operation DetailsTo see details for a delete operation, expand the row by clicking the plus sign (+) next to the date.

Deleted The number of documents that were deleted successfully.

Failed The number of documents that failed to be deleted.

Audited The total number of documents that were audited in the Delete operation, including documents that deleted successfully and documents that failed to delete.A blue number indicates that you can click on it to drill through to the associated Documents Deleted report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Deleted report” on page 129.

Table 17 Body of Search Delete report

Column Description

Table 18 Delete Operation Details in Search Delete report

Column Description

Date The date on which the Delete operation was performed.

User The name of the user who performed the Delete operation.


Deleted Items The number of documents that were deleted successfully.

Failed Items The number of documents that failed to be deleted.

Audited Items The total number of documents that were audited in the Delete operation, including documents that deleted successfully and documents that failed to delete.A blue number indicates that you can click on it to drill through to the associated Documents Deleted report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Deleted report” on page 129.

Job ID The ID of the job associated with the Delete operation.

Search Restore report (Search) 117


Search Restore report (Search)The Search Restore report lists the audited Restore operations that were performed in EMC SourceOne Search.

Prerequisite: Search Restore reportRestore operations are always audited for Administrators.

Before you can run a Search Restore report for audited users, you must enable the Audit restore activities setting and specify the audited users.

To be able to drill through to a Documents Restored report from a Search Restore report, you must enable the Capture document details setting associated with the Audit delete activities setting.


Procedure: Search Restore reportTo run the Search Restore report:

1. Access the Search Restore report. For example: Home > EMC SourceOne > Search Audit Reports > Search Restore Report, as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Search Restore report” on page 118.



Understanding the Search Restore reportThis section describes the information displayed in the Search Restore report.


Figure 67 Example - Search Restore report



Table 19 Body of Search Restore report

Column Description

Date The date on which the Restore operation was performed.

User The display name of the user who performed the Restore operation.


Destination Mailbox The mailbox to which the documents were restored.

Search Restore report (Search) 119


Restore Operation DetailsTo see details for a restore operation, expand the row by clicking the plus sign (+) next to the date.

Restored The number of documents that were restored successfully.

Failed The number of documents that failed to be restored. Refer to “Copy To operations and Restore operations” on page 27 for more information.

Audited The total number of documents that were audited in the Restore operation, including documents that restored successfully and documents that failed to restore.A blue number indicates that you can click on it to drill through to the associated Documents Restored report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Restored report” on page 133.

Table 19 Body of Search Restore report (continued)

Column Description

Table 20 Restore Operation Details in Search Restore report

Column Description

Date The date on which the Restore operation was performed.

User The name of the user who performed the Restore operation.


Restored Items The number of documents that were restored successfully.

Failed Items The number of documents that failed to be restored. Refer to “Copy To operations and Restore operations” on page 27 for more information.

Audited Items The total number of documents that were audited in the Restore operation, including documents that restored successfully and documents that failed to restore.A blue number indicates that you can click on it to drill through to the associated Documents Restored report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Restored report” on page 133.

Destination Mailbox The mailbox to which the documents were restored.

Job ID The ID of the job associated with the Restore operation. The Job ID also is displayed in the Job Management area of the EMC SourceOne console.



File Search Restore report (Search)The File Search Restore report lists the audited file restore operations that were performed in EMC SourceOne Search.

Prerequisite: File Search Restore reportFile restore operations are always audited for Administrators.

Before you can run a File Search Restore report for audited users, you must enable the Audit file restore activities setting and specify the audited users.

To be able to drill through to a Files Restored report from a File Search Restore report, you must enable the Capture document details setting associated with the Audit delete activities setting.


Procedure: File Search Restore reportTo run the File Search Restore report:

1. Access the File Search Restore report. For example: Home > EMC SourceOne > Search Audit Reports > File Search Restore Report, as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the File Search Restore report” on page 121.

File Search Restore report (Search) 121


Understanding the File Search Restore reportThis section describes the information displayed in the File Search Restore report.


Figure 68 Example - File Search Restore report



Table 21 Body of the FIle Search Restore report

Column Description

Date The date on which the File Restore operation was performed.

User The display name of the user who performed the File Restore operation.

Search Role The role of the file search user, as described in “Search roles for SourceOne Search reports” on page 23.

Destination The file server location (UNC path) to which the files are restored:• If the files are restored to all the original locations that they were

archived from, this value is “Original Location”.• If the files are restored to a filtered subset of the original locations,

the filtered path is displayed.• If the files are restored to a new location, the new location displays.



Restore Operation DetailsTo see details for a restore operation, expand the row by clicking the plus sign (+) next to the date.

Restored The number of files that were restored successfully.

Failed The number of files that failed to be restored. Refer to “Copy To operations and Restore operations” on page 27 for more information.

Audited The total number of files that were audited in the File Restore operation, including files that restored successfully and files that failed to restore.A blue number indicates that you can click on it to drill through to the associated Files Restored report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Restored report” on page 133.

Table 21 Body of the FIle Search Restore report (continued)

Column Description

Table 22 Restore Operation Details in File Search Restore report

Column Description

Date The date on which the File Restore operation was performed.

User The name of the user who performed the Restore operation.


Restored Items The number of files that were restored successfully.

Failed Items The number of files that failed to be restored. Refer to “Copy To operations and Restore operations” on page 27 for more information.

File Search Restore report (Search) 123


Audited Items The total number of files that were audited in the Restore operation, including files that restored successfully and files that failed to restore.A blue number indicates that you can click on it to drill through to the associated Files Restored report, if the Capture document details auditing option was enabled. Refer to “Understanding the Documents Restored report” on page 133.

Destination The file server location (UNC path) to which the files are restored:• If the files are restored to all the original locations that they were

archived from, this value is “Original Location”.• If the files are restored to a filtered subset of the original locations,

the filtered path is displayed.• If the files are restored to a new location, the new location

displays.

Job ID The ID of the job associated with the Restore operation. The Job ID also is displayed in the Job Management area of the EMC SourceOne console.

Table 22 Restore Operation Details in File Search Restore report (continued)

Column Description



Documents Copied report (Search)The Documents Copied report lists the items that were copied to mapped folders in EMC SourceOne Search using the Copy To operation.

Prerequisite: Documents Copied reportThe Copy To operation in EMC SourceOne Search is available only for the Administrator search type. Copy To activities are always audited for Administrators.

Before you can run a Documents Copied report for Administrators, you must enable the Capture document details setting associated with the Audit copy to folders activities setting.


Procedure: Documents Copied reportTo run the Documents Copied report:

1. Access the Documents Copied report. For example: Home > EMC SourceOne > Search Audit Reports > Documents Copied Report, as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Documents Copied report” on page 125.

Documents Copied report (Search) 125


Understanding the Documents Copied reportThis section describes the information shown in the Documents Copied report.


Figure 69 Example - Documents Copied report



Table 23 Body of Documents Copied report

Column Description

Date Copied The date on which the document was copied in EMC SourceOne Search.

User The display name of the user who performed the Copy To operation.

Document ID The ID of the copied document.



DetailsTo see details, expand the row by clicking the plus sign (+) next to the date.

Document Date The meaning of this date depends on the document type:• Email: Message date stored in the EMC SourceOne database• SharePoint content: Creation date• Files: Last modified time

Title The title of the document.• For email, this is the subject. • For SharePoint content, this is the title.• For files, this is the file name.

Job ID The ID of the copy job that processed the document, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Copy report. Refer to “Understanding the Search Copy report” on page 112.

Table 23 Body of Documents Copied report (continued)

Column Description

Table 24 Details in Documents Copied report

Section Column Description

Copy Operation Details

Date Copied The date on which the document was copied in EMC SourceOne Search.

User The Administrator search user who performed the Copy To operation.

Destination Folder The name of the EMC SourceOne mapped folder to which the document was copied.

Copy Job ID The ID of the copy job that processed the document, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Copy report.

Documents Copied report (Search) 127


Document Details

Document ID The ID of the copied document.

Document Date The meaning of this date depends on the document type:• Email: Message date stored in the EMC

SourceOne database• SharePoint content: Creation date• Files: Last modified time

Title The title of the document. • For email, this is the subject. • For SharePoint content, this is the title.• For files, this is the file name.

Document Type The type of document (for example, Email Message, Contact, or Meeting).

Size The size of the document.

Attachments Applies to email document types.The number of attachments associated with the document.

Encrypted Applies to email document types.• False = The document is not encrypted.• True = The document is encrypted.For other content types, this is NA (not applicable) or empty.

Sender Applies to email and SharePoint document types.The sender of the document. An email example is:E5 Admin</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin>

Table 24 Details in Documents Copied report (continued)




Documents Deleted report (Search)The Documents Deleted report lists the items that were deleted in EMC SourceOne Search using the Delete operations.

Prerequisite: Documents Deleted reportBefore you can run a Documents Deleted report:

◆ For the Administrator search type, you must enable the Capture document details setting associated with the Audit delete activities setting.

Delete activities are always audited for the Administrator search type.

◆ For audited users, you must:

• Enable the Audit delete activities setting

• Enable the associated Capture document details setting.

• Specify the audited users.

To configure auditing, refer to in the EMC SourceOne Email Management Administration Guide, "Configuring Applications and Web Services" > “Auditing Search operations.”

Procedure: Documents Deleted reportTo run the Documents Deleted report:

1. Access the Documents Deleted report (Home > EMC SourceOne > Search Audit Reports > Documents Deleted Report), as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Documents Deleted report” on page 129.

Documents Deleted report (Search) 129


Understanding the Documents Deleted reportThis section describes the information shown in the Documents Deleted report.


Figure 70 Example - Documents Deleted report


Body of reportRefer to the following table.

Table 25 Body of Documents Deleted report

Column Description

Date Deleted The date on which the document was deleted in EMC SourceOne Search.

User The display name of the user who performed the Delete operation.

Document ID The ID of the document.






Job ID The ID of the delete job that processed the document, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Delete report. Refer to “Understanding the Search Delete report” on page 115.

Table 25 Body of Documents Deleted report (continued)

Column Description

Table 26 Details in Documents Deleted report


Delete Operation Details

Date Deleted The date on which the document was viewed in EMC SourceOne Search.

User The user who performed the Delete operation in Search.

Folder The name of the EMC SourceOne mapped folder from which the document was deleted.

Delete Job ID The ID of the job associated with the search, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Delete report.

Documents Deleted report (Search) 131


Document Details Document ID The ID of the viewed document.







Table 26 Details in Documents Deleted report (continued)




Documents Restored report (Search)The Documents Restored report lists the items that were restored in EMC SourceOne Search using the Restore operation.

Prerequisite: Documents Restored reportBefore you can run a Documents Restored report:

◆ For the Administrator search type, you must enable the Capture document details setting associated with the Audit restore activities setting.

Restore activities are always audited for the Administrator search type.


• Enable the Audit restore activities setting.




Procedure: Documents Restored reportTo run the Documents Restored report:

1. Access the Documents Restored report (Home > EMC SourceOne > Search Audit Reports > Documents Restored Report), as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Documents Restored report” on page 133.

Documents Restored report (Search) 133


Understanding the Documents Restored reportThis section describes the information shown in the Documents Restored report.


Figure 71 Example - Documents Restored report



Table 27 Body of Documents Restored report

Column Description

Date Restored The date on which the document was restored in EMC SourceOne Search.

User The display name of the user who restored the document.







Job ID The ID of the restore job that processed the document, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Activity report. Refer to “Understanding the Search Activity report (Search)” on page 108.

Table 27 Body of Documents Restored report (continued)

Column Description

Table 28 Details in Documents Restored report


Restore Operation Details

Date Restored The date on which the document was restored in EMC SourceOne Search.

User The user who performed the Restore operation in Search.

Destination Mailbox

The mailbox to which the document was restored.

Restore Job ID The ID of the restore job that processed the document, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Restore report.

Documents Restored report (Search) 135


Document Details

Document ID The ID of the viewed document.







Encrypted Applies to email document types.False = The document is not encrypted.True = The document is encrypted.For other content types, this is NA (not applicable) or empty.


Table 28 Details in Documents Restored report (continued)




Files Restored report (Search)The Files Restored report lists the items that were restored in EMC SourceOne Search using the Files Restore operation.

Prerequisite: Files Restored reportBefore you can run a Files Restored report:

◆ For the Administrator search type, you must enable the Capture document details setting associated with the Audit restore activities setting. File restore activities are always audited for the Administrator search type.


• Enable the Audit restore activities setting.




Considerations: Files Restored reportRefer to “Consideration for Search Audit Reports” on page 106.

Procedure: Files Restored reportTo run the Files Restored report:

1. Access the Files Restored report . For example Home > EMC SourceOne > Search Audit Reports > Files Restored Report, as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Files Restored report” on page 137.

Files Restored report (Search) 137


Understanding the Files Restored reportThis section describes the information shown in the Files Restored report.


Figure 72 Example - Files Restored report






Table 29 Body of Files Restored report

Column Description

Date Restored The date on which the file was restored in EMC SourceOne Search.

User The display name of the user who restored the file.

Document ID The ID of the file.

Document Date The last modified time of the file.

Title The file name.

Job ID The ID of the restore job that processed the file, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Activity report. Refer to “Understanding the Search Activity report (Search)” on page 108.

Table 30 Details in Files Restored report


Document Details


Document Date The last modified time of the file.

Title This is the file name.


Files Restored report (Search) 139


Restore Operation Details

Date Restored The date on which the file was restored in EMC SourceOne Search.

User The user who performed the File Restore operation in Search.

Restore Job ID The ID of the restore job that processed the file, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated File Search Restore report.

Destination/ Status

One entry for every location the file was restored to.Each location will display the following status:• Restored – the file was successfully restored to

this location.• Failed – the file could not be restored to this

location.• Skipped – the job did not attempt to restore the

file to this location. A file might be skipped for the following reasons:• A newer version of the file already exists in the

location, and the overwrite option was not enabled• A path filter was specified, and no locations

matched that filter• The user carrying out the restore does not have file

system permissions to this location

Note: If a file fails to be restored to a particular location, no more locations will be processed. If no locations can be processed for the selected file, the Destination value will be "n/a".

Table 30 Details in Files Restored report (continued)




Documents Viewed report (Search)The Documents Viewed report lists the items that were viewed or previewed in EMC SourceOne Search.

Prerequisite: Documents Viewed reportViewed documents are always audited for Administrators.

Before you can run a Documents Viewed report for audited users, you must enable the Audit search result view activities setting and specify audited users.


Procedure: Documents Viewed reportTo run the Documents Viewed report:

1. Access the Documents report (Home > EMC SourceOne > Search Audit Reports > Documents Viewed), as described in “Accessing EMC SourceOne reports” on page 92.



4. To interpret the report, refer to “Understanding the Documents Viewed report” on page 141.

Documents Viewed report (Search) 141


Understanding the Documents Viewed reportThis section describes the information shown in the Documents Viewed report.


Figure 73 Example - Documents Viewed report



Table 31 Body of Documents Viewed report

Column Description

Date Viewed The date on which the document was viewed in EMC SourceOne Search.

User The name of the user who viewed the document.







Job ID The ID of the search job that processed the document, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Activity report. Refer to “Understanding the Search Activity report (Search)” on page 108.

Table 31 Body of Documents Viewed report (continued)

Column Description

Table 32 Details in Documents Viewed report


Activity Details Date Viewed The date on which the document was viewed in EMC SourceOne Search.

User The user who performed the search.

Folder The name of the EMC SourceOne mapped folder where the document was found.

Search Job ID The ID of the job associated with the search, and from which the audit was captured.A blue number indicates that you can click on it to drill through to the associated Search Activity report.

Documents Viewed report (Search) 143


Document Details


Document Date

The meaning of this date depends on the document type:• Email: Message date stored in the EMC SourceOne

database• SharePoint content: Creation date• Files: Last modified time


Document Type

The type of document (for example, Email Message, Contact, or Meeting).



Encrypted Applies to email document types.• False = The document is not encrypted.• True = The document is encrypted.For other content types, this is NA (not applicable) or empty.

Sender Applies to email and SharePoint document types.The sender of the document. For email, this is the EX formatted address, for example:EX:\"E5 Admin\"</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin>

Recipients (partial)

A partial list of the recipients of the document. An example of an email recipient is:E5 Admin</o=first organization/ou=first administrative group/cn=recipients/cn=e5admin>

This field is empty for Delete document-level auditing, and is not applicable to every document type. This field will also be empty for CopyTo and Restore operations unless the document information was captured earlier from a view or preview.

Table 32 Details in Documents Viewed report (continued)




Data Source Processing reportThe Data Source Processing report shows statistics about the data sources processed by a selected EMC SourceOne activity for a specified period of time. The File activities are available if you have EMC SourceOne for File Systems installed. The SharePoint activities are available if you have EMC SourceOne for Microsoft SharePoint installed.

The activities are:

◆ Archive - Historical

◆ Archive - PST/NSF

◆ Archive - User Directed Archive

◆ Delete - Historical

◆ Delete - User Directed Archive

◆ Delete - User Initiated Delete

◆ File Archive - Historical

◆ File Delete - Historical

◆ File Removal

◆ Journal (default)

◆ Migrate - PST

◆ Restore Shortcuts - Historical & UDA

◆ SharePoint Archive

◆ SharePoint Online Archive

◆ Shortcut - Historical

◆ Shortcut - User Directed Archive

◆ Update Shortcuts - Historical & UDA

For SourceOne Email Management activities, the data sources include mailboxes and PSTs.

For SourceOne SharePoint Archive and SharePoint Online Archive activities, the data sources are SharePoint lists.

For File activities, the data sources are file shares.

Data Source Processing report 145


Prerequisites: Data Source Processing report◆ The SharePoint Archive activity and the SharePoint Online

Archive activity are available in the Data Source Processing report if EMC SourceOne for Microsoft SharePoint 7.0 or later is installed on your SourceOne 7.0 or later system.

◆ The following activities are available in the Data Source Processing report if EMC SourceOne for File Systems 6.8 or later is installed on your SourceOne 7.0 or later system:

• File Archive - Historical

• File Delete - Historical

• File Removal

◆ The Data Source Processing report is not an audit report, so no auditing configuration is required.

The report shows information that is always captured in the EMC SourceOne Activity database, including email management data that was captured before you installed EMC SourceOne 7.0. SharePoint and File data are captured starting with EMC SourceOne 7.0.

Considerations and limitations: Data Source Processing reportThe Data Source Processing report shows email, SharePoint, and files processing metrics from the front-end SourceOne Activity database, not email, SharePoint, and files archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct.

Procedure: Data Source Processing reportTo run the Data Source Processing report:

1. Access the Data Source Processing report (Home > EMC SourceOne > System Reports > Data Processing Report), as described in “Accessing EMC SourceOne reports” on page 92.

2. Enter report parameters, as described in “Specifying parameters for the Data Source Processing report” on page 146.




4. To interpret the report, refer to “Understanding the Data Source Processing report” on page 148 and “Drill through to Process Details section” on page 153.

Specifying parameters for the Data Source Processing reportEnter report parameters, as described in the following table.





Figure 74 Data Source Processing report parameters

Table 33 Data Source Processing report parameters










Period To specify a period of time, select an option in the Period field:• Today• Yesterday• This Week• Last Week• This Month• Last Month• This Quarter• Last Quarter• This Year• Last Year• All Dates• Not Specified - Do not select this option; it will not return any


Activity Select an EMC SourceOne activity.The default is Journal.

Detailed Select one of the following options:• True - Generates a Process Details section for the specified

activity, and enables drill through to the Process Details section • False - Does not generate a Process Details section (default).

Table 33 Data Source Processing report parameters (continued)




Understanding the Data Source Processing reportThe Data Source Processing report displays processing statistics for the period and activity that you specified.


Figure 75 Example - Data Source Processing report for Journal activity



Figure 76 Example - Data Source Processing report for SharePoint Online Archive activity



Figure 77 Example - Data Source Processing report for Files Archive - Historical activity

Note: In Internet Explorer 8 and above, text does not wrap in columns if there are no blanks in the text (for example, the SharePoint URLs shown in Figure 76). In printed and exported reports, the text wraps correctly and page width is honored.



Documents/Items/Files sectionFor Email Management activities, this section is labeled Documents. For SharePoint activities, this section is labeled Items. For File activities, this section is labeled Files.

This section shows the number of processed, duplicate, failed, and discarded items for a specific activity.

Table 34 describes the information displayed in the area below the bar graph.

If the Detailed parameter was set to True, then you can click on a blue number to drill through to the Process Details section. Refer to “Drill through to Process Details section” on page 153.

Mailboxes/Data Sources/File Shares sectionFor Email Management activities, this section is labeled Mailboxes. For SharePoint activities:

◆ This section is labeled Data Sources.

◆ A data source is a SharePoint list.

For Files activities, this section is labeled File Shares.

This section shows mailbox, data source, or file share statistics for a specific activity and period or date range.

Table 34 Documents/Items/Files section of Data Source Processing report

Column Description

Processed The total number of items found and processed from the data source by the activity. For archive activities, this number is not necessarily the same as the number of items that are archived.

Duplicate The number of duplicate items in any folder at the time of processing.

Failed The number of items that failed to process successfully in any folder.

Discarded The number of items that were discarded from all folders because they did not match any archiving rules.

Note: This field is used only for Email Management archive activities. This value is 0 for all other Email Management activities and for SharePoint archive activities and File archive activities.

With Attachments The number of items that had attachments.



Table 35 describes the information displayed in the area below the bar graph.

A blue number indicates that you can click on it to drill through to the Process Details section. Refer to “Drill through to Process Details section” on page 153.

Top 10 Mailboxes/Data Sources/FIle Shares sectionThis section shows statistics for the ten mailboxes, data sources, or file shares that had the most items processed for the selected activity and period:

◆ For Email Management activities, this section is labeled Top 10 Mailboxes.

◆ For SharePoint activities, this section is labeled Top 10 Data Sources.

◆ For Files activities, this section is labeled Top 10 File Shares.

Table 35 Mailboxes/Data Sources/File Shares section of Data Source Processing report

Column Description

Total Processed The total number of mailboxes, SharePoint data sources, or file shares processed by the activity for the specified period or date range.

Mailboxes/Data Sources/File Shares With Failed Documents/Items/Files

The number of mailboxes, SharePoint data sources, or file shares with documents, items, or files items that failed to process for the specified period or date range.

Total Size Processed The total size of the mailboxes, SharePoint data sources, or file shares processed for the specified period or date range.

Avg. Mailbox/Data Source/File Share Size

The average size of the mailboxes, SharePoint data sources, or file shares processed for the specified period or date range.

Avg. Processing Time per Mailbox/ Data Source/File Share

The average amount of time to process each mailbox, SharePoint data source, or file share for the specified period or date range.

Avg. Documents/Items/Files per Mailbox/ Data Source/File Share

The average number of items processed for each mailbox, SharePoint data source, or file share for the specified period or date range.



Table 36 describes the information displayed in the area next to the graph.

Drill through to Process Details sectionIf you enabled the Details: True parameter, then:

◆ A Process Details section is generated for the specified activity.

◆ Blue numbers in the Data Sources Processing report indicate that you can drill through to the Process Details section.

Figure 78 Example - Data Source Processing report with Details set to True (Historical Archive activity)

Table 36 Top 10 Mailboxes/Data Sources/FIle Shares section of Data Source Processing report

Column Description

Data Source/File Share

The name of the mailbox, SharePoint data source, or file share.

Processed The total number of items processed for the mailbox, SharePoint data source, or file share by the activity.

Duplicate The number of duplicate items.

Failed The number of items that failed to process for the mailbox, SharePoint data source, or file share.



Figure 79 Example - Data Source Processing report with Details set to True (SharePoint Archive activity)

Figure 80 Example - Data Source Processing report with Details set to True (File Archive - Historical activity)

Click on a blue number to view the associated Process Details section.



Figure 81 Example - Process Details section of Data Source Processing report (Historical Archive activity

Figure 82 Example - Process Details section of Data Source Processing report (SharePoint Archive activity)

Figure 83 Example - Process Details section of Data Source Processing report (File Archive - Historical activity)



The Process Details section shows details about all the data sources that were processed by the specified activity in the specified period or date range.

◆ If the specified date range is within a calendar month, then the first column is labeled Day.

◆ If the specified date range spans two or more calendar months, then the first column is labeled Month.

For example, if you select October 30, 2011 for the Begin Date and November 10, 2011 as the End Date, the first column is labeled Month even though the date range includes fewer than 30 days. The report displays data in months rather than days to save database and reporting resources.

The Total row on each page displays the total for each column for the entire result set.

Table 37 describes the statistics shown for each mailbox.

Table 37 Process Details section

Column Description

Date/Period The date or period in which the data source was processed.

Mailbox/ Data Source/ File Share

The name of the mailbox, SharePoint data source, or file share that was processed.The SharePoint data source name includes the name of the SharePoint list, the URL, and the GUID.

Processed The total number of items processed for the data source.

Duplicate The number of duplicate items.

Failed The number of failed items.

Discarded The number of items that were discarded because they did not match any archiving rules.

Note: This field is used only for Email Management archive activities. This value is 0 for all other Email Management activities and for SharePoint archive activities and File archive activities.

Processed Size (MB)

The total size of all items processed for the data source.



Duplicate Size (MB)

The size of all duplicate items.

Size Before (MB) The size of the data source before processing:• SharePoint activities always display a 0 in this column. • For File activities processed with SourceOne 7.1 and later, this

number reflects the size of the files being processed. The number does not reflect the size of everything in the file share.

• File activities processed prior to SourceOne 7.1 will always display a 0 in this column. .

Size After (MB) The size of the data source after processing:• For Email Management activities, this value may be the same as

the Size Before value if the mail system does not compress or shrink the mailbox after EMC SourceOne processing occurs.

• For SharePoint activities, 0 always displays in this column. • For File activities processed with SourceOne 7.1 and later, this

number reflects the size of the files being processed. It does not reflect the size of everything in the file share. The Size After will typically the same as the size before unless content was deleted or replaced by shortcuts.

• File activities processed prior to SourceOne 7.1 will always display a 0 in this column.

Table 37 Process Details section (continued)

Column Description



Email Management Activity dashboardThe Email Management Activity dashboard shows statistics, trends, and comparisons about commonly-used EMC SourceOne Email Management activities for a specified period of time.

Note: This dashboard shows email processing metrics from the front-end SourceOne Activity database, not email archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct.

Prerequisites: Email Management Activity dashboardThe Email Management Activity dashboard is not an audit report, so no auditing configuration is required. The report shows information that is always captured in the EMC SourceOne Activity database, including data that was captured before you installed EMC SourceOne 6.8 or later.

Procedure: Email Management Activity dashboardTo run the Email Management Activity dashboard:

1. Access the Email Management Activity dashboard, Home > EMC SourceOne > System Reports > Email Management Activity Dashboard, as described in “Accessing EMC SourceOne reports” on page 92.

2. Specify report criteria, as described in “Specifying criteria for the Email Management Activity dashboard” on page 159.

3. Click View Report to generate the report based on your criteria.

4. To interpret the report, refer to the following:

• “Understanding the Email Management Activity dashboard” on page 160

• “Drill through to Data Source Processing report from Email Dashboard” on page 170.

Email Management Activity dashboard 159


Specifying criteria for the Email Management Activity dashboardTo specify report criteria for the Email Management Activity dashboard:

1. Select an activity:

• Summary (default; summary of Journal, Historical Archive, PST/NSF Archive, and User Directed Archive activities)

• Journal

• Historical Archive

• PST/NSF Archive

• User Directed Archive

2. Select a time period:

• Today (default)

• This Week (starts on Monday)

• This Month

• This Quarter

• This Year

3. Select a view:

• Documents (default) - Displays the numbers of processed, failed, duplicate, and discarded items for the selected activity and period.

• Mailboxes - Displays the size of processed mailboxes for the selected activity and period.

• Data - Displays the sizes of processed, failed, duplicate, and discarded items for the selected activity and period.

• Activities - Displays activity statistics for the selected activity for the last five periods.

• Jobs - Displays job statistics for the selected activity for the last five periods.

Figure 84 Email Management Activity dashboard criteria

The dashboard refreshes every time you click on a different activity or period.



Understanding the Email Management Activity dashboardThe Email Management Activity dashboard displays statistics for the period and activity that you specified.

The Report Data Time Zone is displayed in the upper right corner. It is the time zone in which the Activity database SQL Server resides, not the time zone of the client computer.

The view you selected determines which statistics to display. Refer to:

◆ “Documents view” on page 160

◆ “Mailboxes view” on page 163

◆ “Data view” on page 165

◆ “Activities view” on page 166

◆ “Jobs view” on page 169

Documents viewIn the Email Management Activity dashboard, the Documents view displays the number of processed, failed, duplicate, and discarded items for the selected activity and period.



Figure 85 Example - Documents view, Email Management Activity dashboard

Table 38 describes the information shown in the Documents view.

Table 38 Documents view

Graph/section Description

Documents graph Shows the following information for a specific activity.• Processed: The total number of items processed by the activity.• Duplicate: The number of duplicate items in any folder at the time

of processing.• Failed: The number of items that failed to process successfully.• Discarded: The number of items that were discarded because they

did not match any archiving rules.

Duplicate Ratio graph

Shows the percent of processed documents (always 100%) and the percent of duplicate documents.



Document Throughput graph

Shows the document processing rate per minute.The table below the graph lists the document processing rate per minute and the document processing rate per hour for the specified archive activity and period. The document processing rate per day is shown only if the actual time spent processing was greater than 24 hours. Otherwise, the value displayed is N/A (Not Available). In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x100”, and the needle is at “19”, then the rate is 1900 (19 x100) documents per minute. The calculated value is displayed in the box.

Note: The document processing rate does not include time spent on jobs that processed zero (0) items.

Document Failures graph

Shows the percent (%) and number of items that failed processing for the specified activity and period.

Document Processing Trends section

Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• The bar graph shows the number of processed, duplicate, and

failed items for each of the last five periods. The line graph shows the number of documents processed per minute for each of the last five periods.

• The table lists the period; processing rate; the number of processed, duplicate, discarded, and failed items; the percent duplicate; and the percent failed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend.

Table 38 Documents view (continued)




Mailboxes viewIn the Email Management Activity dashboard, the Mailboxes view displays the count, size, and rate of processed mailboxes for the specified activity and period.

Figure 86 Example - Mailboxes view, Email Management Activity dashboard



Table 39 describes the information shown in the Mailboxes view.

Table 39 Mailboxes view


Mailboxes graph Shows the total number of mailboxes processed and the number of mailboxes having items that failed processing for the specified activity and period.

Avg. Mailbox Size Processed graph

Shows the average mailbox size (yellow pointer) and the maximum mailbox size (red rectangle) processed for the specified activity and period.

Mailbox Processing Times graph

Shows the average processing time per mailbox in minutes and the average number of documents processed per mailbox for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x10”, and the needle is at “19”, then the rate is 190 (19 x10) minutes per mailbox. The calculated value is displayed in the box.

Note: The mailbox processing rate shown in Mailboxes view includes the time spent on jobs that processed zero (0) items.

Mailbox Failures graph

Shows the percent (%) and number of mailboxes that failed processing for the specified activity and period.

Mailbox Processing Trends section

Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the number of mailboxes processed, and the

average mailbox processing time in each of the last five periods. • The table lists the period, the average mailbox processing time in

minutes, the number of mailboxes processed, the number of mailboxes processed with failures, the average number of documents processed per mailbox, and the average mailbox size processed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend.



Data viewIn the Email Management Activity dashboard, the Data view displays the size of items processed for the specified activity and period.

Figure 87 Example - Data view, Email Management Activity dashboard

Table 40 describes the information shown in the Data view.

Table 40 Data view


Data graph Shows the total size in gigabytes (GB) for each of processed items, duplicate items, and items with attachments for the specified activity and period.

Data Composition graph

Shows the size of items as a percent: items without attachments, and items with attachments for the specified activity and period.



Activities viewIn the Email Management Activity dashboard, the Activities view displays:

◆ Statistics for the top ten activities based on the number of documents processed

◆ Statistics for specific activities for the last five periods

For the Summary, the graph displays statistics grouped by activity type.

Data Throughput graph

Shows the data processing rate in megabytes (MB) per hour. The table shows the rate in megabytes per hour and per day for the specified activity and period.In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x10”, and the needle is at “19”, then the rate is 190 (19 x10) MB per hour. The calculated value is displayed in the box.

Size at Source graph

Shows the total size of mailboxes before and after processing, and the reduction in mailbox size both in units and as a percent (%) for the specified activity and period. The Before and After values may be the same if the mail system does not compress or shrink mailboxes after EMC SourceOne processing occurs.For PST files, pre-6.8 data will show a file size of 0.

Data Processing Trends section

Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the size of data processed, the size of

duplicates, and the rate (MB processed per hour) for each of the last five periods.

• The table lists the period; processing rate in MB per hour; the size of data processed, the size of duplicates; and mailbox size before and after processing. A green arrow indicates a positive trend compared with the previous period (row). A red arrow indicates a negative trend.

Table 40 Data view (continued)




Figure 88 Example - Activities view, Summary, Email Management Activity dashboard

If you select a specific activity other than Summary, then the graph displays statistics grouped by named activity.



Figure 89 Example - Activities view, Historical Archive, Email Management Activity dashboard

Table 41 describes the information shown in the Activities view.

Table 41 Activities view


Top 10 Activities by Documents Processed section

Displays information for the ten activities that processed the highest number of documents in the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• For each type of activity (Summary) or each named activity, the

graph shows the number of documents processed, the number of duplicate documents, the number of failed documents, and the number of jobs processed.

• The table lists the period, the activity type, the name of each activity, the number of jobs processed, the number of failed jobs, the number of documents processed, the number of duplicate documents, the number of failed documents, the duration of the activity, and the time at which the last job completed for the activity.



Jobs viewIn the Email Management Activity dashboard, the Jobs view displays job statistics for the specified activity and period.

Click the plus sign (+) next to the title of the Job Trends - Last 5 Periods Processed graph to see the associated table.

Figure 90 Example - Jobs view, Email Management Activity dashboard

Table 42 describes the information shown in the Jobs view.

Table 42 Jobs view


Jobs graph Shows the number of jobs processed and the number of failed jobs for the specified activity and period.

Job Trends section Displays information for the last five periods in which processing occurred for the specified activity. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the number of jobs processed, the number of

jobs failed, and the average job processing time in minutes. The average job time includes only the jobs that spent time processing. If a job did not spend any time processing, then it is not included in the average.

• The table lists each period, the number of jobs processed, the average job processing time in minutes, the number of failed jobs, and the percent (%) of failed jobs.

Job Failures graph Shows the percent (%) and number of failed jobs for the specified activity and period.



Drill through to Data Source Processing report from Email DashboardIn the Email Management Activity dashboard for any activity type except Summary, if the Detailed parameter is set to True, you can click on a blue number to drill through to the associated Data Source Processing report.

For example, in the Documents view for the Historical Archive activity type, you can drill through the Processed value under the Documents graph or through the dates in the Document Processing Trends table. You can also click on the Documents graph or the Document Processing Trends graph.

Figure 91 Example - Drill through enabled in Email Management Activity dashboard

For information about the Data Source Processing report, refer to “Understanding the Data Source Processing report” on page 148.



Example: Drill through to list of processed PST filesTo see a list of the PST files processed by the PST Archive activity:

1. In the Email Management Activity dashboard:

a. Select PST/NSF Archive.

b. Select the period.

c. Select one of the following views: Documents, Mailboxes, or Data.

Figure 92 Example - Mailboxes view for a PST/NSF Activity report

d. Click on a blue number to drill through to the Data Source processing report.



Figure 93 Example - Drill through to Data Source Processing report - PST/NSF Activity

2. In the Data Source Processing report, click on a blue number to see details for all of the PST files that were processed.

Figure 94 Example - Drill through to PST/NSF Archive Process details

Search Activity dashboard 173


Search Activity dashboardThe Search Activity dashboard shows statistics about the following EMC SourceOne Search and Discovery Manager jobs for the specified period of time:

◆ EMC SourceOne Search - search, copy, and restore jobs

◆ Discovery Manager - search, copy, and export jobs

It shows statistics for all users, including audited users and non-audited users.

Prerequisites: Search Activity dashboardBy default, the Administrator search type is always audited, and so Search Activity dashboards always include that information. No configuration is required.

If you want to be able to drill through the Search Activity dashboard to the Search Activity audit report, then you must configure audited users, as described in the EMC SourceOne Email Management Administration Guide, "Configuring Applications and Web Services" > “Auditing Search operations.”

Procedure: Search Activity dashboardTo run the Search Activity dashboard:

1. Access the Search Activity Dashboard report. For example: Home > EMC SourceOne > System Reports > Search Activity Dashboard, as described in “Accessing EMC SourceOne reports” on page 92.

2. Enter report criteria, as described in “Specifying criteria for the Search Activity dashboard” on page 174.


4. To interpret the dashboard, refer to the following:

• “Understanding the Search Activity dashboard” on page 175

• “Drill through to the Search Activity report for Search” on page 179.



Specifying criteria for the Search Activity dashboardTo specify report criteria for the Search Activity dashboard:

1. Select a search activity:

• Summary (summary of all search activities; default)

• Web Search - Searches performed in EMC SourceOne Search

• Web Copy & Restore - Copy operations and restore operations performed in EMC SourceOne Search

• DM Search - Searches performed in EMC SourceOne Discovery Manager

• DM Export & Copy - Export operations and copy operations performed in EMC SourceOne Discovery Manager


• Today (default)


• This Month

• This Quarter

• This Year

3. Select a view:

• Jobs (default)

• Trends

• Composition (available only for the Summary activity type)

Figure 95 Search Activity dashboard criteria

The dashboard refreshes every time you select new criteria.



Understanding the Search Activity dashboardThe Search Activity dashboard report shows statistics about EMC SourceOne search jobs and activities for the period and activity type that you specified. It shows statistics for all users, including audited users and non-audited users.

The upper right corner of the dashboard displays the time zone in which the Activity database SQL Server resides, not the time zone of the client computer.

The view you selected determines which statistics to display.

Refer to:

◆ “Jobs view” on page 175

◆ “Trends view” on page 176

◆ “Composition view” on page 178

Jobs viewThe Jobs view displays job statistics for the specified period and type of search activity.

Figure 96 Example - Jobs view, Search Activity dashboard



Table 43 describes the information shown in the Jobs view.

Trends viewThe Trends view shows job statistics for the last five periods during which processing occurred for the specified type of search activity.

Figure 97 Example - Trends view, Search Activity dashboard

Table 44 describes the information shown in the Trends view.

Table 43 Jobs view


Jobs graph Shows the number of submitted, completed, and failed jobs for the specified search activity and period.

Documents graph Shows the number of processed and failed documents for the specified search activity and period.

Execution Times graph

Shows the average execution time in seconds and the average number of jobs submitted per day for the specified search activity and period.In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x1”, and the needle is at “19”, then the average execution rate is 19 (19 x 1) seconds. The calculated value is displayed in the box.

Jobs Failures Shows the number and percent (%) of failed jobs.



Table 44 Trends view


Job Processing Trends section

Displays job processing trends for the last five periods in which the specified search activity occurred. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the number of jobs submitted, the number of

jobs that failed, and the average job execution time in seconds.• The table shows the period; the average job execution time in

seconds; the numbers of submitted, completed, and failed jobs; and the percent (%) of failed jobs. A green arrow indicates an improvement in execution time compared with the previous period (row). A red arrow indicates a negative trend.



Composition viewThe Composition view is available when you select Summary as the activity type. It is not available for other activity types.

The Composition view shows the number and percent of jobs for each type of search activity, and the percent of each type of search user for the specified period.

Figure 98 Example - Composition view, Search Activity dashboard

Table 45 describes the information shown in the Composition view.

Table 45 Composition view


Activity Type Composition graph

Shows the percent (%) of each search activity type for the specified period.

Job Trends by Type graph

Shows the number of submitted search jobs by the type of search activity, and the average time it took to complete searches in the EMC SourceOne Web Search application for the last five periods.

User Type Composition graph

Shows the percent (%) of activities performed by each search role for the specified period. Refer to “Search roles for SourceOne Search reports” on page 23.User searches are purged periodically from the system, so the composition graph may change even if no new searches are performed. For example, the composition graph may show an increase in the ratio of Administrator searches to user searches after user searches are purged, even if no new Administrator searches have been performed.



Drill through to the Search Activity report for SearchIn the Search Activity dashboard for the Web Search activity type only, you can click on a blue number to drill through to the associated Search Activity report. You can drill through from the Jobs view or the Trends view.

Figure 99 Example - Web Search activity type, Search Activity dashboard

Note: Since the Search Activity dashboard shows statistics for all users, including audited users and non-audited users, the counts may not match those shown on the Search Activity audit report.

For information about the Search Activity report, refer to “Understanding the Search Activity report (Search)” on page 108.



SharePoint Management Activity DashboardThe SharePoint Management Activity dashboard shows statistics, trends, and comparisons about the EMC SourceOne for Microsoft SharePoint archive activities for a specified period of time.

Note: This dashboard shows SharePoint processing metrics from the front-end Activity database, not archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct.

Prerequisites: SharePoint Management Activity Dashboard◆ EMC SourceOne for Microsoft SharePoint 7.0 must be installed on

your SourceOne 7.0 system.

◆ The SharePoint Management Activity dashboard is not an audit report, so no auditing configuration is required. The report shows information that is always captured in the EMC SourceOne Activity database, including SharePoint data that is captured starting with EMC SourceOne 7.0 and EMC SourceOne for Microsoft SharePoint 7.0.

Procedure: SharePoint Management Activity dashboardTo run the SharePoint Management Activity dashboard:

1. Access the SharePoint Management Activity dashboard (Home > EMC SourceOne > System Reports > SharePoint Management Activity Dashboard), as described in “Accessing EMC SourceOne reports” on page 92.

2. Enter report criteria, as described in “Procedure: SharePoint Management Activity dashboard” on page 180.



• “Understanding the SharePoint Management Activity Dashboard” on page 182

• “Drill through to Data Source Processing report from SharePoint Dashboard” on page 192.

SharePoint Management Activity Dashboard 181


Specifying criteria for the SharePoint Management Activity dashboardTo specify report criteria for the SharePoint Management Activity dashboard:


• Summary (default; summary of SharePoint Archive and SharePoint Online Archive activities)

• SharePoint Archive

• SharePoint Online Archive


• Today (default)


• This Month

• This Quarter

• This Year

3. Select a view:

• Items (default) - Displays the numbers of processed, failed, duplicate, and discarded items for the selected activity and period.

• Data Sources - Displays the size of processed data sources for the selected activity and period.

• Data - Displays the sizes of processed, failed, duplicate, and discarded items for the selected activity and period.



Figure 100 SharePoint Management Activity Dashboard criteria




Understanding the SharePoint Management Activity DashboardThe SharePoint Management Activity Dashboard displays statistics for the period and activity that you specified.



◆ “Items view - SharePoint Management Activity Dashboard” on page 182

◆ “Data Sources view - SharePoint Management Activity Dashboard” on page 185

◆ “Data view - SharePoint Management Activity Dashboard” on page 187

◆ “Activities view - SharePoint Management Activity Dashboard” on page 188

◆ “Jobs view - SharePoint Management Activity Dashboard” on page 191

Items view - SharePoint Management Activity DashboardIn the SharePoint Management Activity Dashboard, the Items view displays the number of processed, failed, duplicate, and discarded items for the selected activity and period.



Figure 101 Example - Items view, SharePoint Management Activity Dashboard

The following table describes the information shown in the Items view.

Table 46 Items view - SharePoint Management Activity Dashboard


Items graph Shows the following information for a specific activity.• Processed: The total number of items processed by the activity.• Duplicate: The number of duplicate items in any folder at the time

of processing.• Failed: The number of items that failed to process successfully.• Discarded: The number of items that were discarded because

they did not match any archiving rules.


Shows the percent of processed items (always 100%) and the percent of duplicate items.



Item Throughput graph

Shows the item processing rate per minute.The table below the graph lists the item processing rate per minute and the item processing rate per hour for the specified archive activity and period. The item processing rate per day is shown only if the actual time spent processing was greater than 24 hours. Otherwise, the value displayed is N/A (Not Available). In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x100”, and the needle is at “19”, then the rate is 1900 (19 x100) items per minute. The calculated value is displayed in the box.

Note: The item processing rate does not include time spent on jobs that processed zero (0) items.

Item Failures graph Shows the percent (%) and number of items that failed processing for the specified activity and period.

Item Processing Trends section


failed items for each of the last five periods. The line graph shows the number of items processed per minute for each of the last five periods.

• The table lists the period; processing rate; the number of processed, duplicate, discarded, and failed items; the percent duplicate; and the percent failed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend.

Table 46 Items view - SharePoint Management Activity Dashboard (continued)




Data Sources view - SharePoint Management Activity DashboardIn the SharePoint Management Activity Dashboard, the Data Sources view displays the count, size, and rate of processed data sources for the specified activity and period.

Figure 102 Example - Data Sources view, SharePoint Management Activity Dashboard



The following table describes the information shown in the Data Sources view.

Table 47 Data Sources view - SharePoint Management Activity Dashboard


Data Sources graph

Shows the total number of data sources processed and the number of data sources having items that failed processing for the specified activity and period.

Avg. Data Source Size Processed graph

Shows the average data source size (yellow pointer) and the maximum data source size (red rectangle) processed for the specified activity and period.

Data Source Processing Times graph

Shows the average processing time per data source in minutes and the average number of documents processed per data source for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x10”, and the needle is at “19”, then the rate is 190 (19 x10) minutes per data source. The calculated value is displayed in the box.

Note: The data source processing rate shown in Data Sources view includes the time spent on jobs that processed zero (0) items.

Data Source Failures graph

Shows the percent (%) and number of data sources that failed processing for the specified activity and period.

Data Source Processing Trends section

Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the number of data sources processed, and the

average data source processing time in each of the last five periods.

• The table lists the period, the average data source processing time in minutes, the number of data sources processed, the number of data sources processed with failures, the average number of items processed per data source, and the average data source size processed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend.



Data view - SharePoint Management Activity DashboardIn the SharePoint Management Activity Dashboard, the Data view displays the size of items processed for the specified activity and period.

Figure 103 Example - Data view, SharePoint Management Activity Dashboard

The following table describes the information shown in the Data view.

Table 48 Data view - SharePoint Management Activity Dashboard


Data graph Shows the total size for each of processed items, duplicate items, and items with attachments for the specified activity and period.


Shows the size of items as a percent: items without attachments, and items with attachments for the specified activity and period.



Activities view - SharePoint Management Activity DashboardIn the SharePoint Management Activity dashboard, the Activities view displays:

◆ Statistics for the top ten activities based on the number of items processed






Not applicable for SharePoint archive activities.


Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the size of data processed, the size of duplicates,

and the rate (MB processed per hour) for each of the last five periods.

• The table lists the period; processing rate in MB per hour; the size of data processed, and the size of duplicates. The Size Before and Size After columns do not apply to SharePoint archive activities. A green arrow indicates a positive trend compared with the previous period (row). A red arrow indicates a negative trend.

Table 48 Data view - SharePoint Management Activity Dashboard (continued)




Figure 104 Example - Activities view, Summary, SharePoint Management Activity Dashboard


Figure 105 Example - Activities view, SharePoint Archive, SharePoint Management Activity Dashboard



The following table describes the information shown in the Activities view.

Table 49 Activities view - SharePoint Management Activity Dashboard


Top 10 Activities by Items Processed section

Displays information for the ten activities that processed the highest number of items in the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• For each type of activity (Summary) or each named activity, the

graph shows the number of items processed, the number of duplicate items, the number of failed items, and the number of jobs processed.

• The table lists the period, the activity type, the name of each activity, the number of jobs processed, the number of failed jobs, the number of items processed, the number of duplicate items, the number of failed items, the duration of the activity, and the time at which the last job completed for the activity.



Jobs view - SharePoint Management Activity DashboardIn the SharePoint Management Activity dashboard, the Jobs view displays job statistics for the specified activity and period.


Figure 106 Example - Jobs view, SharePoint Management Activity Dashboard

The following table describes the information shown in the Jobs view.

Table 50 Jobs view - SharePoint Management Activity Dashboard









Drill through to Data Source Processing report from SharePoint DashboardIn the SharePoint Management Activity Dashboard for any activity type except Summary, if the Detailed parameter is set to True, you can click on a blue number to drill through to the associated Data Source Processing report.

For example, in the Items view for the SharePoint Archive activity type, you can drill through the Processed value under the Items graph or through the dates in the Item Processing Trends table.

You can also click on the Items graph or the Item Processing Trends graph.

Figure 107 Example - Drill through enabled in SharePoint Management Activity Dashboard


Files Management Activity Dashboard 193


Files Management Activity DashboardThe Files Management Activity dashboard shows statistics, trends, and comparisons about the EMC SourceOne for File Systems activities (File Archive - Historical, File Delete - Historical, and File Removal) for a specified period of time.

Note: This dashboard shows file processing metrics from the front-end Activity database, not archiving metrics from the back-end archive server. Reconciliation with the archive may not be correct.

Prerequisites: Files Management Activity Dashboard◆ EMC SourceOne for File Systems 6.8 or later must be installed on

your SourceOne 7.0 system.

◆ The Files Management Activity dashboard is not an audit report, so no auditing configuration is required. The report shows information that is always captured in the EMC SourceOne Activity database, including files data that is captured starting with EMC SourceOne 7.0 and EMC SourceOne for File Systems 6.8.

Procedure: Files Management Activity dashboardTo run the Files Management Activity dashboard:

1. Access the Files Management Activity dashboard (Home > EMC SourceOne > System Reports > Files Management Activity Dashboard), as described in “Accessing EMC SourceOne reports” on page 92.

2. Enter report criteria, as described in “Specifying criteria for the Files Management Activity dashboard” on page 194.



• “Understanding the Files Management Activity Dashboard” on page 195

• “Drill through to Data Source Processing report from Files Dashboard” on page 205.



Specifying criteria for the Files Management Activity dashboardTo specify report criteria for the Files Management Activity dashboard:


• Summary (default; summary of File Archive - Historical, File Delete - Historical, and File Removal activities)

• File Archive - Historical

• File Delete - Historical

• File Removal


• Today (default)


• This Month

• This Quarter

• This Year

3. Select a view:

• Files (default) - Displays the numbers of processed, failed, duplicate, and discarded files for the selected activity and period.

• File Shares - Displays the size of processed file shares for the selected activity and period.

• Data - Displays the sizes of processed, failed, duplicate, and discarded files for the selected activity and period.



Figure 108 Files Management Activity Dashboard criteria




Understanding the Files Management Activity DashboardThe Files Management Activity Dashboard displays statistics for the period and activity that you specified.



◆ “Files view - Files Management Activity Dashboard” on page 195

◆ “File Shares view - Files Management Activity Dashboard” on page 198

◆ “Data view - Files Management Activity Dashboard” on page 200

◆ “Activities view - Files Management Activity Dashboard” on page 202

◆ “Jobs view - Files Management Activity Dashboard” on page 204

Files view - Files Management Activity DashboardIn the Files Management Activity Dashboard, the Files view displays the number of processed, failed, duplicate, and discarded files for the selected activity and period.



Figure 109 Example - Files view, Files Management Activity Dashboard

The following table describes the information shown in the Files view.



Table 51 Files view - Files Management Activity Dashboard


Files graph Shows the following information for a specific activity.• Processed: The total number of files processed by the activity.• Duplicate: The number of duplicate files in any folder at the time of

processing.• Failed: The number of files that failed to process successfully.• Discarded: The number of files that were discarded because they

did not match any archiving rules.


Shows the percent of processed items (always 100%) and the percent of duplicate files.

Files Throughput graph

Shows the file processing rate per minute.The table below the graph lists the file processing rate per minute and the file processing rate per hour for the specified activity and period. The item processing rate per day is shown only if the actual time spent processing was greater than 24 hours. Otherwise, the value displayed is N/A (Not Available). In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x100”, and the needle is at “19”, then the rate is 1900 (19 x100) files per minute. The calculated value is displayed in the box.

Note: The file processing rate does not include time spent on jobs that processed zero (0) files.

File Failures graph Shows the percent (%) and number of files that failed processing for the specified activity and period.

File Processing Trends section


failed ifiles for each of the last five periods. The line graph shows the number of files processed per minute for each of the last five periods.

• The table lists the period; processing rate; the number of processed, duplicate, discarded, and failed files; the percent duplicate; and the percent failed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend.



File Shares view - Files Management Activity DashboardIn the Files Management Activity Dashboard, the File Shares view displays the count, size, and rate of processed file shares for the specified activity and period.

Figure 110 Example - File Shares view, Files Management Activity Dashboard



The following table describes the information shown in the Data Sources view.

Table 52 File Shares view - Files Management Activity Dashboard


File Shares graph Shows the total number of file shares processed and the number of file shares having files that failed processing for the specified activity and period.

Avg. File Share Size Processed graph

Shows the average file share size (yellow pointer) and the maximum file share size (red rectangle) processed for the specified activity and period.

File Share Processing Times graph

Shows the average processing time per file share in minutes and the average number of files processed per file share for the specified activity and period. In the gauge, the red multiplier value applies to the needle. For example, if the multiplier value is “x10”, and the needle is at “19”, then the rate is 190 (19 x10) minutes per file share. The calculated value is displayed in the box.

Note: The file share processing rate shown in File Shares view includes the time spent on jobs that processed zero (0) items.

File Share Failures graph

Shows the percent (%) and number of file shares that failed processing for the specified activity and period.

File Share Processing Trends section

Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the number of file shares processed, and the

average file share processing time in each of the last five periods. • The table lists the period, the average file share processing time

in minutes, the number of file shares processed, the number of file shares processed with failures, the average number of files processed per file share, and the average file share size processed. A green arrow indicates an improving trend compared with the previous period (row). A red arrow indicates a negative trend.



Data view - Files Management Activity DashboardIn the Files Management Activity Dashboard, the Data view displays the size of items processed for the specified activity and period.

Figure 111 Example - Data view, Files Management Activity Dashboard



The following table describes the information shown in the Data view.

Table 53 Data view - Files Management Activity Dashboard


Data graph Shows the total size for each of processed files, duplicate files, and completed files for the specified activity and period.For File Archive or File Delete activities:• "Processed" refers to the files that were handled by the activity.• "Duplicate" refers to files that were already archived including

from another location. It is not applicable for File Delete activities.• "Completed" refers to files that were successfully archived or

deleted from the file system. For File Removal activities:• "Processed" refers to the virtual file locations processed for

cleanup from the database.• "Duplicate" is not applicable.• "Completed" refers to virtual files that were deleted from the

database.


Shows the size of files as a percent: processed files, and completed files for the specified activity and period.Not applicable for File Removal activities.




Consider the following:• For File activities processed with SourceOne 7.1 and later, shows

the total size of processed files before and after processing, and the reduction in file size both in units and as a percent (%) for the specified activity and period.

• The Before and After values will typically be the same unless files are deleted or shortcut after archiving. This number reflects the size of the files being processed, not the size of everything in the file share.

• The Before and After size is not recorded for File activities processed prior to SourceOne 7.1, and will therefore be treated as 0.



Activities view - Files Management Activity DashboardIn the Files Management Activity dashboard, the Activities view displays:

◆ Statistics for the top ten activities based on the number of items processed





Displays information for the last five periods in which processing occurred. If no processing occurred in a period, then that period is not displayed in this section.• The graph shows the size of data processed, the size of

duplicates, and the rate (MB processed per hour) for each of the last five periods.

• The table lists the period; processing rate in MB per hour; the size of data processed, and the size of duplicates. The Size Before and Size After columns do not apply to SharePoint archive activities and Files activities. A green arrow indicates a positive trend compared with the previous period (row). A red arrow indicates a negative trend.

Table 53 Data view - Files Management Activity Dashboard (continued)




Figure 112 Example - Activities view, File Archive - Historical, Files Management Activity Dashboard

The following table describes the information shown in the Activities view.

Table 54 Activities view - Files Management Activity Dashboard


Top 10 Activities by Files Processed section

Displays information for the ten activities that processed the highest number of files in the last five periods in which processing occurred, ordered by the sum of the processed file count. If no processing occurred in a period, then that period is not displayed in this section.• For each type of activity (Summary) or each named activity, the

graph shows the sum of files processed, the sum of duplicate files, the sum of failed files, and the sum of jobs processed.

• The table lists the period, the activity type, the name of each activity, the number of jobs processed, the number of failed jobs, the number of ifiles processed, the number of duplicate files, the number of failed files, the duration of the activity, and the time at which the last job completed for the activity.



Jobs view - Files Management Activity DashboardIn the Files Management Activity dashboard, the Jobs view displays job statistics for the specified activity and period.


Figure 113 Example - Jobs view, Files Management Activity Dashboard

The following table describes the information shown in the Jobs view.

Table 55 Jobs view - Files Management Activity Dashboard









Drill through to Data Source Processing report from Files DashboardIn the Files Management Activity Dashboard for any activity type except Summary, if the Detailed parameter is set to True, you can click on a blue number to drill through to the associated Data Source Processing report.




Running EMC Discovery Manager Reports 207

7

This chapter describes how to access and viewDiscovery Manager reports.

◆ Accessing Discovery Manager reports ......................................... 208◆ Search Activity report (Discovery Manager) ............................... 210◆ Assign to Hold Folder report (Discovery Manager)................... 218◆ Delete from Hold Folder report (Discovery Manager)............... 224◆ Documents Viewed report (Discovery Manager)........................ 230◆ Export Activity report (Discovery Manager) ............................... 237

To export and print reports, refer to “Working with reports” on page 30.

Running EMC Discovery Manager

Reports


Running EMC Discovery Manager Reports

Accessing Discovery Manager reportsTo access Discovery Manager reports:

1. In Internet Explorer 7.0 or higher, enter the URL for your SQL Server 2008, 2008 R2, or 2012 Reporting Services, as provided by your system administrator.

The SQL Server Reporting Services home page opens. It displays the EMC Discovery Manager folder. If EMC SourceOne reports are installed, then the EMC SourceOne folder is also displayed.

Figure 114 EMC Discovery Manager folder on SQL Server 2008 R2 Reporting Services home page

2. Click the Discovery Manager folder to open it.

The Discovery Manager page displays the Search Audit Reports subfolder.

Figure 115 EMC Discovery Manager reports - Search Audit Reports subfolder

3. Open the Search Audit Reports subfolder to access the reports.

Accessing Discovery Manager reports 209


Figure 116 EMC Discovery Manager reports on SQL Server 2008 Reporting Services

4. To run a report, refer to:

• “Search Activity report (Discovery Manager)” on page 210

• “Assign to Hold Folder report (Discovery Manager)” on page 218

• “Delete from Hold Folder report (Discovery Manager)” on page 224

• “Documents Viewed report (Discovery Manager)” on page 230

• “Export Activity report (Discovery Manager)” on page 237



Search Activity report (Discovery Manager)The Discovery Manager Search Activity report lists the collection searches that were performed by users in the Discovery Manager client or with the DMCollect utility.

Note: Discovery Manager search operations that are incomplete will be partially audited, but will not be included in reports.

Prerequisite: Search Activity report (Discovery Manager)Collection searches are always audited. No auditing configuration is required.

Considerations: Search Activity Report (Discovery Manager)Refer to “Considerations for Discovery Manager reports” on page 28.

Procedure: Search Activity report (Discovery Manager)To run the Search Activity report for Discovery Manager:

1. Access the Search Activity report (Home > EMC Discovery Manager > Search Audit Reports > Search Activity Report), as described in “Accessing Discovery Manager reports” on page 208.

2. Enter report parameters, as described in “Specifying parameters for Search Activity report (Discovery Manager)” on page 211.


4. To interpret the report, refer to “Understanding the Search Activity report (Discovery Manager)” on page 213.

Search Activity report (Discovery Manager) 211


Specifying parameters for Search Activity report (Discovery Manager)Specify parameters for the Discovery Manager > Search Audit Reports > Search Activity report as described in Table 56.

Figure 117 Example - default parameters for Search Activity (Discovery Manager) report





Table 56 Search Activity (Discovery Manager) report parameters










Period To specify a period of time, select an option in the Period field:• Today• Yesterday• Last 24 Hours• This Week• Last Week• This Month• Last Month• This Quarter• Last Quarter• This Year• Last Year• All Dates• Not Specified - Do not select this option; it will not return any


User The User field lists the names of all Discovery Manager users.To specify the search user, select an option in the User field:• All (default)• The name of a Discovery Manager user

Matter The list of matters depends on what you selected in the User field:• If you selected All in the User field, then the Matter field lists the

names of all matters that have ever had a search executed in Discovery Manager.

• If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had a search executed by the selected user in Discovery Manager.

Note: If a matter was renamed, and if searches were executed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all searches associated with a specific matter ID will be displayed in report results.

To specify the matter, select an option in the Matter field:• All (default)• The name of a Discovery Manager matter

Table 56 Search Activity (Discovery Manager) report parameters (continued)




Understanding the Search Activity report (Discovery Manager)This section describes the information displayed in the Search Activity report for Discovery Manager.

Times are based on the time zone in which the SQL Server resides that hosts the Discovery Manager database, not the time zone of the client computer.

Figure 118 Example - Search Activity report (Discovery Manager)

Matter Details Select one of the Matter Details options:• True (default) - Displays the Matter Details section when you

expand a row in the report. Refer to “Matter Details” on page 217 for a description.

• False - Does not display the Matter Details section when you expand a row in the report.


Table 56 Search Activity (Discovery Manager) report parameters (continued)




Figure 119 Example - Search Activity report (Discovery Manager) - details



Table 57 Body of Search Activity report (Discovery Manager)

Column Description

Date The date on which the collection search was performed.

User The name of the Discovery Manager user who performed the search.

Folders The names of the EMC SourceOne mapped folders that were searched.

Search Terms The search criteria.If the user did not specify criteria, then the Search Terms column displays Date <= 2037-12-31.



Search Operation DetailsTo see details for a search operation, expand the row by clicking the plus sign (+) next to the date.

SearchID The internal ID of the collection search.

Archive Hits The number of items in the SourceOne archive that matched search criteria.

Displayed Hits The number of matching items displayed in search results.

Note: The number of Displayed Hits may not match the number of Archived Hits. Refer to “Considerations for Discovery Manager reports” on page 28.

Table 57 Body of Search Activity report (Discovery Manager) (continued)

Column Description

Table 58 Search Operation Details in Search Activity report (Discovery Manager)

Column Description

Date The date on which the collection search was performed.

User The name of the Discovery Manager user who performed the collection search.

Note: In SourceOne 7.0, this name is the Windows SID of the user. In SourceOne 6.8.1, this name was the canonical address of the user in the mail system.

Search ID The internal ID of the collection search.

Search Name The name of the collection search, as displayed in the navigation pane.

Search Type In this release, the Search Type is always Collection.

Archive Hits The number of items in the SourceOne archive that matched search criteria.

Displayed Hits The number of matching items displayed in search results.

Note: The number of Displayed Hits may not match the number of Archived Hits. Refer to “Considerations for Discovery Manager reports” on page 28.



Maximum Hits Requested

The maximum number of search results.The Discovery Manager Application Administrator specifies the global default in the Maximum Search Hits option in Discovery Manager Configuration settings.The Discovery Manager user can change this value for a specific search in the Max Search Results field in the Search Properties dialog box

Search Full Text Indexes

The Discovery Manager Application Administrator specifies the global default in the Search Full Text Indexes option in Discovery Manager Configuration settings. Refer to "Configuring Discovery Manager" in the EMC SourceOne Discovery Manager User Guide.The Discovery Manager user can change this value for a specific search in the "Always search full text indexes" option of the Search Properties dialog box. Refer to "Editing search properties" in the EMC SourceOne Discovery Manager User Guide.Values:• True = Performed a full-text index search.• False = Performed a relational search.

Folders Searched The names of the EMC SourceOne mapped folders that were searched.

Search Terms The search criteria. If the user did not specify criteria, then the Search Terms field displays Date <= 2037-12-31.

Enhanced EmailXtender Duplicate Tracking

In Discovery Manager Configuration settings, the Discovery Manager Application Administrator specifies whether or not EmailXtender duplicate messages are tracked. Refer to "Configuring Discovery Manager" in the EMC SourceOne Discovery Manager User Guide.Values:• True = EmailXtender duplicate messages are tracked in the

Discovery Manager client and can be displayed.• False = EmailXtender duplicate messages are not tracked in the

Discovery Manager client.

Table 58 Search Operation Details in Search Activity report (Discovery Manager) (continued)

Column Description



Matter DetailsTo see matter details for a collection search:

1. In the report parameters, select Matter Details: True.

2. Expand the row by clicking the plus sign (+) next to the date.

Table 59 Matter Details (Discovery Manager)

Column Description

Name The name of the matter associated with the operation.

Last Modified The date and time on which the matter was last modified.

Matter ID The internal ID of the matter.

Hold Folder The name of the hold folder specified in matter properties.

Collection Sources The names of the EMC SourceOne mapped folders specified as search folders in matter properties.

Custodians The names of custodians specified in matter properties.

Keywords The keywords specified in matter properties.

Custom Metadata The custom metadata specified in matter properties.



Assign to Hold Folder report (Discovery Manager)The Assign to Hold Folder report lists the Assign Results to Matter operations that were performed in matters associated with a hold folder.

Note: Hold folders and the Assign Results to Matter operation are available in the full edition of Discovery Manager.

Prerequisite: Assign to Hold Folder report (Discovery Manager)Assign to hold folder operations are always audited. No auditing configuration is required.

Considerations: Assign to Hold Folder report (Discovery Manager)Refer to “Considerations for Discovery Manager reports” on page 28.

Procedure: Assign to Hold Folder report (Discovery Manager)To run the Assign to Hold Folder report for Discovery Manager:

1. Access the Assign to Hold Folder report. For example, Home > EMC Discovery Manager > Search Audit Reports > Assign to Hold Folder Report, as described in “Accessing Discovery Manager reports” on page 208.

2. Enter report parameters, as described in “Specifying parameters for Assign to Hold Folder report (Discovery Manager)” on page 219.


4. To interpret the report, refer to “Understanding the Assign to Hold Folder report (Discovery Manager)” on page 221.

Assign to Hold Folder report (Discovery Manager) 219


Specifying parameters for Assign to Hold Folder report (Discovery Manager)Specify parameters for the Discovery Manager > Search Audit Reports > Assign to Hold Folder report as described in Table 60 on page 219.

Figure 120 Example - default parameters for Assign to Hold Folder report (Discovery Manager)





Table 60 Assign to Hold Folder (Discovery Manager) report parameters


Begin Date Do one of the following steps:• If you do not want to specify a Begin Date, select the NULL checkbox

(default).• To specify a Begin Date, clear the NULL checkbox, click the calendar

icon, then select a date. The Period field defaults to Not Specified.

End Date Do one of the following steps:• If you do not want to specify an End Date, select the NULL checkbox

(default).• To specify an End Date, clear the NULL checkbox, click the calendar




Period To specify a period of time, select an option in the Period field:• Today• Yesterday• Last 24 Hours• This Week• Last Week• This Month• Last Month• This Quarter• Last Quarter• This Year• Last Year• All Dates• Not Specified - Do not select this option; it will not return any results.

It is displayed automatically if you specify a Begin Date or an End Date.

User The User field lists the names of all Discovery Manager users.To specify the user, select an option in the User field:• All (default)• The name of a Discovery Manager user


names of all matters that have ever had an assign to hold folder operation performed in Discovery Manager.

• If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had an assign to hold folder operation performed by the selected user in Discovery Manager.

Note: If a matter was renamed, and if assign to hold folder operations were performed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all assign to hold folder operations associated with a specific matter ID will be displayed in report results.


Table 60 Assign to Hold Folder (Discovery Manager) report parameters (continued)




Understanding the Assign to Hold Folder report (Discovery Manager)This section describes the information displayed in the Assign to Hold Folder report for Discovery Manager.


Figure 121 Example - Assign to Hold Folder report (Discovery Manager)

Matter Details Select one of the Matter Details options:• True (default) - Displays the Matter Details section when you expand

a row in the report.• False - Does not display the Matter Details section when you expand

a row in the report.

Expand All Groups

Select one of the Expand All Groups options:• True - Expands all rows and sections to display details.• False (default) - Does not expand all rows and sections.

Table 60 Assign to Hold Folder (Discovery Manager) report parameters (continued)




Figure 122 Example - Assign to Hold Folder report (Discovery Manager) - details



Table 61 Body of Assign to Hold Folder report (Discovery Manager)

Column Description

Date The date on which the assign to hold folder operation was performed.

User The name of the Discovery Manager user who performed the assign to hold folder operation.

Matter The name of the matter associated with the assign to hold folder operation.

Hold Folder The name of the hold folder associated with the matter. The assigned items were copied to this hold folder.

Assigned The total number of items that were assigned to the hold folder.

Failed The number of assigned items that failed to copy to the hold folder.



Assign Operation DetailsTo see details for an assign to hold folder (copy) operation, expand the row by clicking the plus sign (+) next to the date.

Matter DetailsTo see matter details for an assign to hold folder operation:



Refer to Table 59 on page 217.

Table 62 Assign Operation Details in Assign to Hold Folder report (Discovery Manager)

Column Description

Date The date on which the assign to hold folder operation was performed.

User The name of the Discovery Manager user who performed the assign to hold folder operation.

Note: This name is the Windows SID of the user.

Matter The name of the matter.

Hold Folder The name of the hold folder associated with the matter. The assigned items were copied to this hold folder.

Assigned Items The total number of items that were assigned to the hold folder.

Failed Items The number of assigned items that failed to copy to the hold folder.

Operation ID The internal ID of the assign to hold folder operation.



Delete from Hold Folder report (Discovery Manager)The EMC Discovery Manager > Search Audit Reports > Delete from Hold Folder report lists the delete operations that were performed in matters associated with a hold folder. These operations include:

◆ User deletion of selected items that were assigned to a matter, performed in the Matter Review area

◆ Deletion of all items from a matter’s hold folder when a user deletes the matter

Note: Hold folders are available in the full edition of Discovery Manager.

Prerequisite: Delete from Hold Folder report (Discovery Manager)Delete from hold folder operations are always audited. No auditing configuration is required.

Considerations: Delete from Hold Folder report (Discovery Manager)Refer to “Considerations for Discovery Manager reports” on page 28.

Procedure: Delete from Hold Folder report (Discovery Manager)To run the Delete from Hold Folder report for Discovery Manager:

1. Access the Assign to Hold Folder report. For example: Home > EMC Discovery Manager > Search Audit Reports > Assign to Hold Folder Report, as described in “Accessing Discovery Manager reports” on page 208.

2. Enter report parameters, as described in “Specifying parameters for Delete from Hold Folder report (Discovery Manager)” on page 225.


4. To interpret the report, refer to “Understanding the Delete from Hold Folder report (Discovery Manager)” on page 227.

Delete from Hold Folder report (Discovery Manager) 225


Specifying parameters for Delete from Hold Folder report (Discovery Manager)Specify parameters for the Discovery Manager > Search Audit Reports > Delete from Hold Folder report as described in Table 63 on page 225.

Figure 123 Example - default parameters for Delete from Hold Folder report (Discovery Manager)





Table 63 Delete from Hold Folder (Discovery Manager) report parameters












User The User field lists the names of all Discovery Manager users.To specify the user, select an option in the User field:• All (default)• The name of a Discovery Manager user


names of all matters that have ever had an assign to hold folder operation performed in Discovery Manager.

• If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had an assign to hold folder operation performed by the selected user in Discovery Manager.

Note: If a matter was renamed, and if delete from hold folder operations were performed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all delete from hold folder operations associated with a specific matter ID will be displayed in report results.


Table 63 Delete from Hold Folder (Discovery Manager) report parameters (continued)




Understanding the Delete from Hold Folder report (Discovery Manager)This section describes the information displayed in the Delete from Hold Folder report for Discovery Manager.


Figure 124 Example - Delete from Hold Folder report (Discovery Manager)


expand a row in the report. • False - Does not display the Matter Details section when you

expand a row in the report.


Table 63 Delete from Hold Folder (Discovery Manager) report parameters (continued)




Figure 125 Example - Delete from Hold Folder report (Discovery Manager) - details



Table 64 Body of Delete from Hold Folder report (Discovery Manager)

Column Description

Date The date on which the delete from hold folder operation was performed.

User The name of the Discovery Manager user who performed the delete from hold folder operation.

Matter The name of the matter associated with the delete from hold folder operation.

Hold Folder The name of the hold folder associated with the matter. The assigned items were deleted from this hold folder.

Deleted The number of items that were deleted successfully from the hold folder.

Failed The number of items that failed to delete from the hold folder.



Delete Operation DetailsTo see details for delete from hold folder operation, expand the row by clicking the plus sign (+) next to the date.

Matter DetailsTo see matter details for a delete from hold folder operation:




Table 65 Delete Operation Details in Delete from Hold Folder report (Discovery Manager)

Column Description

Date The date on which the delete from hold folder operation was performed.

User The name of the Discovery Manager user who performed the delete from hold folder operation.


Matter The name of the matter.

Hold Folder The name of the hold folder associated with the matter. The items were deleted from this hold folder.

Deleted Items The number of items that were deleted successfully from the hold folder.

Failed Items The number of items that failed to delete from the hold folder.

Operation ID The internal ID of the delete from hold folder operation.



Documents Viewed report (Discovery Manager)The Discovery Manager Documents Viewed report lists the documents in collection searches that were viewed by users in the Discovery Manager client application.

Note: There will be multiple audits if a user views the same document in the same matter.

Prerequisite: Documents Viewed report (Discovery Manager)Collection searches and documents viewed are always audited. No auditing configuration is required.

Procedure: Documents Viewed report (Discovery Manager)To run the Documents Viewed report for Discovery Manager:

1. Access the Search Activity report. For example, Home > EMC Discovery Manager > Search Audit Reports > Documents Viewed Report, as described in “Accessing Discovery Manager reports” on page 208.

2. Enter report parameters, as described in “Specifying parameters for Documents Viewed report (Discovery Manager)” on page 231.


4. To interpret the report, refer to “Understanding the Documents Viewed report (Discovery Manager)” on page 233.

Documents Viewed report (Discovery Manager) 231


Specifying parameters for Documents Viewed report (Discovery Manager)Specify parameters for the Discovery Manager > Search Audit Reports > Documents Viewed report as described in Table 66 on page 231.

Figure 126 Example - default parameters for Documents Viewed (Discovery Manager) report





Table 66 Documents Viewed (Discovery Manager) report parameters


Begin Date Do one of the following steps:• If you do not want to specify a Begin Date, select the NULL checkbox

(default).• To specify a Begin Date, clear the NULL checkbox, click the calendar


End Date Do one of the following steps:• If you do not want to specify an End Date, select the NULL checkbox

(default).• To specify an End Date, clear the NULL checkbox, click the calendar




Period To specify a period of time, select an option in the Period field:• Today• Yesterday• Last 24 Hours• This Week• Last Week• This Month• Last Month• This Quarter• Last Quarter• This Year• Last Year• All Dates• Not Specified - Do not select this option; it will not return any results. It

is displayed automatically if you specify a Begin Date or an End Date.


Matter The list of matters depends on what you selected in the User field:• If you selected All in the User field, then the Matter field lists the names

of all matters that have ever had documents viewed in Discovery Manager.

• If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had documents viewed by the selected user in Discovery Manager.

Note: If a matter was renamed, and if document views or previews were performed in the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all searches associated with a specific matter ID will be displayed in report results.


Table 66 Documents Viewed (Discovery Manager) report parameters (continued)




Understanding the Documents Viewed report (Discovery Manager)This section describes the information displayed in the Documents Viewed report for Discovery Manager.


Figure 127 Example - Documents Viewed report (Discovery Manager)

Matter Details Select one of the Matter Details options:• True (default) - Displays the Matter Details section when you expand a

row in the report. Refer to “Matter Details” on page 217 for a description.


Expand All Groups

Select one of the Expand All Groups options:• True - Expands all rows and sections to display details.• False (default) - Does not expand all rows and sections.

Table 66 Documents Viewed (Discovery Manager) report parameters (continued)




Figure 128 Example - Documents Viewed report (Discovery Manager) - details



Table 67 Body of Documents Viewed report (Discovery Manager)

Column Description

Date Viewed The date on which the document was viewed.

User The name of the Discovery Manager user who viewed the document.

Document ID The internal ID of the document.

Document Date The “most significant” date for the document’s content type.

Title The subject of an email item or SharePoint item, or the name of a file.



View DetailsTo see details for a view operation, expand the row by clicking the plus sign (+) next to the date.

Associated Search DetailsTo see details for the search associated with a view operation, expand the row by clicking the plus sign (+) next to the date.

Note: This section is included for view operations performed in the Collection Area in the Discovery Manager client application. It is not included for view operations performed in the Matter Review Area.

Table 68 Search Operation Details in Documents Viewed report (Discovery Manager)

Column Description

Date Viewed The date on which the document was viewed.

User The name of the Discovery Manager user who viewed the document.


Viewed From The area in Discovery Manager from which the user viewed the document: Collection.Area or Matter Review.

Table 69 Associated Search Details in Documents Viewed report (Discovery Manager)

Column Description

Search Name The name of the collection search associated with the viewed document.

Search Terms The search criteria. If the user did not specify criteria, then the Search Terms column displays Date <= 2037-12-31.

Search Folders The names of the SourceOne mapped folders that were searched.

Search Type In this release, the Search Type is always Collection.



Matter DetailsTo see matter details for a view operation:



Document DetailsTo see details for a view operation, expand the row by clicking the plus sign (+) next to the date.

Table 70 Matter Details (Discovery Manager)

Column Description

Name The name of the matter associated with the operation.

Matter ID The internal ID of the matter.

Table 71 Document Details in Documents Viewed report (Discovery Manager)

Column Description

Document ID The internal ID of the document.

Document Date The “most significant” date for the document’s content type.

Title The title or subject of the document.

Document Type The content type of the document.


Has Attachments Indicates whether or not the document has attachments:• True = has attachments• False = does not have attachments

Encrypted Indicates whether or not the document is encrypted:• True = is encrypted• False = is not encrypted

Sender For email content types, the display name of the sender.

Recipients (partial) For email content types, the display name of the recipients. This is a partial list of recipients.

Export Activity report (Discovery Manager) 237


Export Activity report (Discovery Manager)The Discovery Manager Export Activity report lists the export operations that were performed by users in the Discovery Manager client application.

Prerequisite: Export Activity report (Discovery Manager)Exports are always audited. No auditing configuration is required.

Procedure: Export Activity report (Discovery Manager)To run the Export Activity report for Discovery Manager:

1. Access the Search Activity report. For example, Home > EMC Discovery Manager > Search Audit Reports > Export Activity Report, as described in “Accessing Discovery Manager reports” on page 208.

2. Enter report parameters, as described in “Specifying parameters for Export Activity report (Discovery Manager)” on page 237.


4. To interpret the report, refer to “Understanding the Export Activity report (Discovery Manager)” on page 240.

Specifying parameters for Export Activity report (Discovery Manager)Specify parameters for the Discovery Manager > Search Audit Reports > Export Activity report as described in Table 72 on page 238.

Figure 129 Example - Default parameters for Export Activity report (Discovery Manager)







Table 72 Export Activity (Discovery Manager) report parameters














names of all matters that have ever had documents viewed in Discovery Manager.

• If you selected the name of a Discovery Manager user in the User field, then the Matter field lists the names of the matters that have ever had documents viewed by the selected user in Discovery Manager.

Note: If a matter was renamed, and if searches were executed for the renamed matter, then the Matter field lists all the names of the matter. Since the report uses the internal matter ID to identify the matter, all searches associated with a specific matter ID will be displayed in report results.



expand a row in the report. Refer to “Matter Details” on page 217 for a description.



Table 72 Export Activity (Discovery Manager) report parameters (continued)




Understanding the Export Activity report (Discovery Manager)This section describes the information displayed in the Export Activity report for Discovery Manager.


Figure 130 Example - Export Activity report (Discovery Manager)



Figure 131 Example - Export Activity report (Discovery Manager) - details


Body of reportEach row shows information for one export operation.

Table 73 Body of Export Activity report (Discovery Manager)

Column Description

Date The date on which the export was created.

User The name of the Discovery Manager user who created the export.

Export ID The internal ID of the export.

Exported The number of items that exported successfully.



Export ConfigurationTo see configuration information for an export operation, expand the row by clicking the plus sign (+) next to the date. The Export Configuration section shows the options that were selected in the Export dialog box when the export was created.

Failed The number of items that failed to export.

Output Files The total number of container files and metadata files produced in this export.

Output Size The total size of container files and metadata files produced in this export.

Processing Time The duration of the export job.

Status Status of the export operation:• Green check = All items exported successfully• Exclamation mark = Some items failed to export.• Red X = All items failed to export.

Table 73 Body of Export Activity report (Discovery Manager) (continued)

Column Description

Table 74 Export Configuration - Export Activity report (Discovery Manager)

Field Description

Date The date on which the export was created.

User The name of the Discovery Manager user who created the export.

Export ID The internal ID of the export.

Export Name The name of the export specified in the Export dialog.

Container Type The container type (None, Native, NSF, PST, or File System) that was selected in the Export dialog.

Metadata Type The metadata type (None, CSV, TSV, or EDRM) that was selected in the Export dialog.

Separate by Custodian

Indicates whether the Split By Custodian option was selected in the Export dialog:• True = The Split By Custodian option was selected.• False = The Split By Custodians option was not selected.



Export ResultsTo see information about the export results for an export operation, expand the row by clicking the plus sign (+) next to the date.

Maximum File Size The value specified in the Split By File Size field in the Export dialog.

Export Data Location

The location specified in the File Location field in the Export dialog.

Enhanced EmailXtender Duplicate Tracking

In Discovery Manager Configuration settings, the Discovery Manager Application Administrator specifies whether or not EmailXtender duplicate messages are tracked. Refer to "Configuring Discovery Manager" in the EMC SourceOne Discovery Manager User Guide.Values:• True = EmailXtender duplicate messages are tracked in the

Discovery Manager client and can be displayed.• False = EmailXtender duplicate messages are not tracked in the

Discovery Manager client.

Table 74 Export Configuration - Export Activity report (Discovery Manager) (continued)

Field Description

Table 75 Export Results - Export Activity report (Discovery Manager)

Field Description

Submitted The number of items selected for export.

Expected The number of items that Discovery Manager calculated to be exported, based on options selected in the Export dialog. For example, assume 100 items were selected (submitted) for export and the Split By Custodian option was enabled. If 75 messages were tagged with CustodianA and 40 messages were tagged with CustodianB, then the Expected count would be 115 (75 + 40).

Exported The number of items that exported successfully.

Failed The number of items that failed to export.

Output Files The total number of container files and metadata files produced in this export.

Total Size The total size of container files and metadata files produced in this export.



ContainersTo see details about the container files and metadata files produced by an export operation, expand the row by clicking the plus sign (+) next to the date, then click the plus sign (+) next to the Containers section.

CustodiansThe Custodians section is available if you selected the Split by custodian option in the Export dialog. To see details about the custodians associated with an export operation, expand the row by clicking the plus sign (+) next to the date, then click the plus sign (+) next to the Custodians section.

Maximum File Size The value specified in the Split By File Size field in the Export dialog.

Export Data Location

The location specified in the File Location field in the Export dialog.

Errors If errors occurred, then this field lists the error messages.If no errors occurred, then this field is blank.

Table 75 Export Results - Export Activity report (Discovery Manager) (continued)

Field Description

Table 76 Containers - Export Activity report (Discovery Manager)

Field Description

Name Lists the name of each container file and metadata file produced by the export. For information about how output files are named, refer to the EMC SourceOne Discovery Manager User Guide.

Table 77 Custodians - Export Activity report (Discovery Manager)

Field Description

Custodian The name of the custodian.

Container The names of the container files and metadata files produced for the custodian.



Matter DetailsTo see the properties of the matter associated with an export operation:






Customizing Reports 247

8

This chapter explains how to customize the reports supplied with EMC SourceOne, and is organized as follows:

◆ Changing parameter defaults......................................................... 248◆ Adding a company logo.................................................................. 253

Customizing Reports


Customizing Reports

Changing parameter defaultsTo customize parameter labels for a report, modify the parameter properties.

IMPORTANT!Modify only the parameters that are documented in this chapter. Modifying unsupported parameters may result in incorrect reports, or may require reinstalling the reports. Parameters may change in future releases, so backward compatibility is not guaranteed.

Required permissionsTo change parameter defaults, you must have one of the following roles in SQL Server Reporting Services:

◆ System Administrator role

◆ Content Manager role

Accessing the parameter properties for a reportNavigation to the report properties differs depending on the version of SQL Server (2008 or 2008 R2).

Note: The following examples show how to navigate to the EMC SourceOne Search Activity report properties in both SQL Server 2008 and SQL Server 2008 R2.

To access the parameter properties for a report:

1. Do one of the following steps:

• For SQL Server 2008:

a. Navigate to the specific report. For example, EMC SourceOne > Search Audit Reports > Search Activity Report.

b. Click the Properties tab.

Changing parameter defaults 249

Customizing Reports

Figure 132 In SQL Server 2008, click the report’s Properties tab

• For SQL Server 2008 R2:

a. Navigate to the folder containing the report. For example, EMC SourceOne > Search Audit Reports.

b. Select Manage in the report’s dropdown menu.

Figure 133 In SQL Server 2008 R2, select Manage in the report’s dropdown menu

2. On the left side of the report’s Properties page, select Parameters.


Customizing Reports

Figure 134 Parameter properties - Search Activity report - SQL Server 2008

Figure 135 Parameter properties - Search Activity report - SQL Server 2008 R2

Changing parameter defaults 251

Customizing Reports

3. Continue to the appropriate section:

• “Changing the Expand All Groups default” on page 251

• “Changing the maximum row count” on page 251

• “Modifying the footer text” on page 252

• “Changing the Detailed default” on page 252

• “Changing the Activity Type default” on page 253

4. To save your changes to the Parameters property page, click Apply.

Changing the Expand All Groups defaultYou can change the Expand All Groups default for individual Search Audit reports.

By default, the Expand All Groups parameter is set to False. When set to True, this parameter expands all rows and sections in the report to display details.

To change the Expand All Groups default:

1. Access the parameters of the Search Audit report you want to modify, as described in “Accessing the parameter properties for a report” on page 248.

2. On the Parameters page, change the Default Value of the ExpandGroups parameter to True.

3. Click Apply.

Changing the maximum row countYou can change the MaxRowCount default for individual Search Audit reports, for individual Configuration reports, and for the Data Source processing report.

By default, the MaxRowCount parameter is not visible for users to modify on the report’s parameter panel. The current MaxRowCount default is shown in the Report Configuration section of the report. By default, MaxRowCount set to 10000.


Customizing Reports

To change the MaxRowCount default:

1. Access the parameters of the report you want to modify, as described in “Accessing the parameter properties for a report” on page 248.

2. On the Parameters page, change the Default Value of the MaxRowCount parameter to the value you want.

3. Click Apply.

Modifying the footer textYou can change the footer text for individual reports of any type.

By default, the footer text is set to Company Confidential - For internal use only.

To change the footer text:

1. Access the parameters of the report you want to modify, as described in “Accessing the parameter properties for a report” on page 248.

2. On the Parameters page, change the Default Value of the FooterText parameter to the text you want.

3. Click Apply.

Changing the Detailed defaultYou can change the Detailed default for the Data Source Processing report.

By default, the Detailed parameter is set to False. When set to True, this parameter generates a Process Details section for the specified activity, and enables drill through to the Process Details section.

To change the Detailed default:

1. Access the parameters of the Data Source Processing report, as described in “Accessing the parameter properties for a report” on page 248.

2. On the Parameters page, change the Default Value of the Detailed parameter to True.

3. Click Apply.

Adding a company logo 253

Customizing Reports

Changing the Activity Type defaultYou can change the Activity Type default for the Data Source Processing report.

By default, the Activity Type parameter is set to Journal.

To change the Activity Type default:

1. Access the parameters of the Data Source Processing report, as described in “Accessing the parameter properties for a report” on page 248.

2. On the Parameters page, change the Default Value of the ActivityType parameter to the activity of your choice.

3. Click Apply.

Adding a company logoYou can add a company logo that will appear in the upper right corner of every report.

The dimensions of the logo area are:

◆ Width: 1.00 inch

◆ Height: 0.75 inch

Figure 136 Example - Custom logo


Customizing Reports

Required permissionsTo add a company logo, you must have one of the following roles in SQL Server Reporting Services:

◆ System Administrator role

◆ Content Manager role

Procedure: Adding a company logoTo add a company logo to all EMC SourceOne reports or to all Discovery Manager reports:

1. On the SQL Server Reporting Services home page, do one of the following steps, depending on which group of reports you want to customize:

• Open the EMC SourceOne folder.

• Open the Discovery Manager folder.

Note: The examples in this procedure show the EMC SourceOne folder. The steps are the same for the Discovery Manager folder.

2. Click Details View on the toolbar.

Figure 137 EMC SourceOne folder - default Tile View

The Details View displays.

Adding a company logo 255

Customizing Reports

Figure 138 EMC SourceOne folder - Details View

3. Open the Images folder.

Figure 139 Images folder

4. To backup the default logo.jpg:

• Select Manage from the image’s dropdown menu.

• On the image’s Properties page, rename the image in the Name field.


Customizing Reports

Figure 140 Default logo.jpg Properties page

5. To add your logo to the Images directory:

a. Click Upload File on the toolbar.

b. Rename your logo to logo.jpg.

6. Run a report to verify that your logo appears in the upper right corner.

Best Practices Auditing and Reporting 257

9

This chapter explains best practices for SourceOne auditing and reporting.

Best Practices Auditing and Reporting



Auditing and reporting best practicesReview the following best practices.

SQL Server upgrade from 2005 to 2008If you are upgrading the SQL Server that hosts the EMC SourceOne databases from SQL Server 2005 to SQL Server 2008:

1. Before you upgrade to EMC SourceOne 6.8:

a. Upgrade to SQL Server 2008.

b. Run the current version of EMC SourceOne to verify the product baseline.

2. After you successfully upgrade to SQL Server 2008:

a. Upgrade to EMC SourceOne 6.8.

b. Run the 6.8 version of EMC SourceOne to verify performance.

Perform regular backups and maintenanceBack up EMC SourceOne before and after upgrading, perform regular backups of the Activity database to preserve audit information, and verify the integrity of the backups.

Perform regular maintenance of the Activity database, physical integrity checks, and defragmentation of indexes.

Refer to the EMC SourceOne Email Management Administration Guide for information on backups and database maintenance.

I/O activity increases on SQL Server When you run a report, for a short time there can be significant I/O activity on the SQL Server that hosts the EMC SourceOne Activity database.

The amount of I/O activity depends on the:

◆ Audit records being requested

◆ Amount of historical data in the Activity database

When you refresh a report, database I/O activity may occur.

Auditing and reporting best practices 259


Input and display of date and time in EMC SourceOne reportsInput of date and time in reports:

◆ The input of date and time in report parameters depends on the regional settings of your SQL Server Reporting Services computer.

◆ Date parameter fields can accept times in any format including AM/PM. This ensures that time reporting is consistent and unambiguous across cultures and languages, especially for cultures that do not have an AM/PM designator.

Note: If you specify a time in the Data Source Processing report’s Begin Date or End Date parameter, the time is ignored. The report displays an entire day’s worth of data at minimum. Data for this report is captured and displayed at the daily level.

Display of date and time in reports:

◆ The display of date and time is normalized to ISO/ODBC 24-hour format (YYYY-MM-DD HH:mm:ss) in all reports, including report data, the Report Configuration section, header, and footer.

◆ Tooltips dates do not use the 24-hour format, but use the regional settings format of the SQL Server Reporting Services computer instead.

◆ For weekly calculations, Monday is considered the first day of the week.

◆ Q1 is the January-to-March quarter.

Customizing reportsThe dimensions of the logo area are:

◆ Width: 1.00 inch

◆ Height: 0.75 inch

Lifecycle of audited dataAudited data and system report data are not purged.



Troubleshooting Auditing and Reporting 261

10

This chapter explains how to troubleshoot SourceOne auditing and reporting, and is organized as follows:

◆ Troubleshooting EMC SourceOne auditing ................................. 262◆ Troubleshooting EMC SourceOne reporting................................ 264

Troubleshooting Auditing and Reporting



Troubleshooting EMC SourceOne auditingRefer to:

◆ “Search audit failures” on page 262

◆ “Actions of audited users are not being audited” on page 262

Search audit failuresFor security reasons, search audit failures are not reported to users.

Search audit failures are listed in the Event Log, for example:

...Search Audit: Auditing failed, document <DocID: 0000000043B689D51DA05B17E596FA657F33B1C4F25AD11F00> will not be retrieved/deleted. (0x86042A0A)

To find details about specific search audit failures, look at the following trace logs:

◆ Search job is not being created – ExSearchWebService log

◆ Search view/preview failure – DocManageService log

◆ CopyTo/Restore failure – ExJBRestore.exe log

◆ Delete from Archive failure – ExJBDeleteFromArchive.exe log

Actions of audited users are not being auditedIf actions of audited users are not being audited, the most likely cause is that the Audited Users LDAP Query did not synchronize successfully.

To verify the status of the last Address Book synchronization:

◆ In the EMC SourceOne console, look at the Sync Status on the Audited Users tab of the Search Audit Settings dialog box (Application Configuration node > Search Audit Settings).

◆ In the EMC Event Log, see if there are errors such as:

The number of users exceeded the specified limit. One or more users were skipped.

◆ If there are errors, look in the ExSyncService.exe.log trace for details.

Troubleshooting EMC SourceOne auditing 263


If this is the initial synchronization, no users will be audited until the problem is resolved.

If at least one synchronization completed successfully, auditing will continue to use the last set of users until the problem is resolved.

To fix the problem, test the LDAP query on the Audited Users tab of the Search Audit Settings dialog by clicking the Execute button. Verify that:

◆ The query resolves successfully against the selected LDAP server.

◆ The number of results does not exceed the Maximum Audited Users value.



Troubleshooting EMC SourceOne reportingRefer to:

◆ “Errors when installing reports” on page 264

◆ “Errors when viewing reports” on page 265

◆ “Using SQL Server Reporting Services internal logs” on page 266

Errors when installing reportsTable 3 lists report installation errors and possible actions.

Table 3 Report installation errors and actions

Error Action

Could not open a con-nection to SQL Server

For EMC SourceOne reports, ensure that you specified the correct name of the EMC SourceOne Activity database and that the Activ-ity database is available.For EMC Discovery Manager reports, ensure that you specified the correct name of the EMC Discovery Manager database and that the Discovery Manager database is available.

Database ‘database-name' does not exist

For EMC SourceOne reports, ensure that you specified the correct name of the EMC SourceOne Activity database.For EMC Discovery Manager reports, ensure that you specified the correct name of the EMC Discovery Manager database.

Error 404: Report Server Web Service not found

Verify that this is the URL shown on the Web Service URL page of SQL Server Reporting Services Configuration Manager.

Login failed for user ‘user’

Verify that the user who is running the installation has the required permissions:• For EMC SourceOne reports, refer to "Configuring SQL per-

missions" in the EMC SourceOne Email Management Installa-tion Guide.

• For EMC Discovery Manager reports, refer to "Configuring SQL permissions" in the EMC SourceOne Discovery Manager Installation and Administration Guide.

• The Content Manager role in SQL Server Reporting Services.

Troubleshooting EMC SourceOne reporting 265


Errors when viewing reportsTable 4 lists report viewing errors and possible actions.

The installation times out.

Verify that the SQL Server Reporting Services web service is ready by browsing to the Web Service URL. (This is the URL shown on the Web Service URL page of SQL Server Reporting Services Configuration Manager.) If you attempt to install EMC SourceOne reports or EMC Discovery Manager reports before this web service is ready, then the installation may time out.

Table 3 Report installation errors and actions (continued)

Error Action

Table 4 Report viewing errors and actions

Error Action

The permissions granted to user are insufficient for performing this operation. (rsAccessDenied)

Ensure that the user has the required permissions on the EMC SourceOne reports, EMC Discovery Manager reports, or report folders in SQL Server Reporting Ser-vices. Refer to ““Controlling access to EMC SourceOne and Discovery Manager reports” on page 81”.

Cannot create a connection to data source 'dsES1Activity'. (rsErrorOpeningConnection)

• Ensure that the EMC SourceOne Activity database server can be reached.

• Ensure that the user has Connect and Execute per-missions on the EMC SourceOne Activity database. Refer to ““Controlling access to EMC SourceOne and Discovery Manager reports” on page 81” for additional required permissions.

Cannot create a connection to data source 'dsES1DM'. (rsErrorOpeningConnection)

• Ensure that the EMC Discovery Manager database server can be reached.

• Ensure that the user has Connect and Execute per-missions on the EMC Discovery Manager database. Refer to ““Controlling access to EMC SourceOne and Discovery Manager reports” on page 81” for additional required permissions.



Using SQL Server Reporting Services internal logsSQL Server Reporting Services includes the following logs that may be helpful for troubleshooting. Consult Microsoft documentation for details.

◆ Execution log - Logs report execution data, such as the report export format, parameters, and performance data.

◆ Trace log - Logs trace output from the report server, including exception information.

◆ HTTP log - Logs HTTP requests handled by the Report Server and Report Manager.

◆ Windows Event Log - Logs the Report Server events, such as error conditions.

◆ Setup log - Contains trace output from the SQL Server 2008 setup program that could help you troubleshoot setup issues.

Login failed for user 'NT AU-THORITY\ANONYMOUS LOGON' (rsErrorOpeningConnection)

This error may occur when SQL Server Reporting Ser-vices is installed on a separate computer from the SQL Server that hosts the EMC SourceOne databases.Windows Authentication without Kerberos 5 enabled cannot pass credentials across more than one com-puter.Refer to ““Authenticating with the EMC SourceOne Ac-tivity database” on page 85” and "“Authenticating with the EMC Discovery Manager database” on page 87" for information about changing connection credentials for the Activity data source and the Discovery Manager data source.

Table 4 Report viewing errors and actions (continued)

Error Action


Aaudit

customizing reports 247EMC SourceOne 11running reports 91, 207troubleshooting 257, 261

auditing of EMC SourceOne 12

Ccustomizing audit reports 247

EEMC SourceOne

audit 11, 12

Iinstallation

EMC SourceOne reports 39

Rreports

auditing 12, 247authenticating with the Activity database 85authenticating with the Discovery Manager

database 87configuring Internet Explorer to support 88configuring SQL Server Report Server 56controlling access to 81hardware and software requirements 45high availability options 44

installing EMC Discovery Manager reports 77

installing EMC SourceOne Reporting 39installing EMC SourceOne reports 72installing SQL Server Reporting Services 47maintaining the installation 89planning checklist 41pre-deployment planning 43running 91, 207SQL Server requirements 43troubleshooting 257, 261verifying installation of SQL Server Report

Server 71requirements


SSQL Server

EMC SourceOne Reporting 39system requirements


Ttroubleshooting audit reports 257, 261

Index


Index