# Commvault Console - Operations Recorded by the Audit Trail

The following table lists the operations that are recorded at each severity level.

Security Level | Operation
--- | ---
Critical | Abort Media in VaultTracker Action
Critical | Change Client CommServe Host Name
Critical | Change Client Host Name
Critical | Change Client Name
Critical | Change SharePoint Archiver Prune Settings
Critical | Close Case
Critical | Company marked for delete
Critical | Create Case
Critical | Deconfigure a Storage Node in Expert Storage Configuration Tool
Critical | Delete a Client Group
Critical | Delete a Library
Critical | Delete a Mount Path
Critical | Delete Backup Set
Critical | Delete Case
Critical | Delete Client from Search Engine
Critical | Delete company
Critical | Delete Content Director Legal Hold
Critical | Delete Content Director Policy
Critical | Delete Content Director Record Center
Critical | Delete Content Director Search
Critical | Delete Content Director Tag
Critical | Delete Content Index for Job
Critical | Delete Content Indexing for Storage Policy
Critical | Delete Controller for Mount Path
Critical | Delete Custom Calendar
Critical | Delete Deduplication for Storage Policy Copy
Critical | Delete Disk Media Content
Critical | Delete ERM Connector
Critical | Delete Export Location
Critical | Delete History of VaultTracker Action
Critical | Delete Iron Mountain Customer ID
Critical | Delete Media
Critical | Delete Media Container
Critical | Delete Media Contents and Move Media
Critical | Delete Replication Policy
Critical | Delete Replication Set
Critical | Delete Schedule
Critical | Delete Schedule Policy
Critical | Delete Search Engine
Critical | Delete Snapshot
Critical | Delete Spare Group
Critical | Delete Storage Policy
Critical | Delete Storage Policy Copy
Critical | Delete User
Critical | Delete User group
Critical | Delete VaultTracker Policy
Critical | Deleted Filer Management
Critical | Disable Backups for Storage Policy Copy
Critical | Disallow Copy Jobs in Media
Critical | Erase Backup Data
Critical | Erase Media
Critical | Execute QScript
Critical | Export and Delete Media
Critical | Force Delete Snapshot
Critical | Full Erase Media
Critical | Full Erase Media in Library
Critical | Hard Delete Client
Critical | Hard Delete iDataAgent
Critical | Job Based Pruning
Critical | Kill All Jobs
Critical | Mark Recall Done for Media in VaultTracker Action
Critical | Move Media between Libraries
Critical | Oracle RMAN Cross-Check Disabled
Critical | Oracle RMAN Cross-Check Enabled
Critical | Quick Erase Media
Critical | Quick Erase Media in Library
Critical | Ransomware protection detected unauthorized access
Critical | Recall Media
Critical | Release license for Agent
Critical | Release license for MediaAgent
Critical | Release licenses for client
Critical | Remove Deduplication Access Path
Critical | Revert Snapshot
Critical | Suspend All Jobs
Critical | Update Custom Calendar
Critical | Update Storage Policy Copy Properties
High | A SCSI2 reservation release was attempted for a drive but failed.
High | Add New User
High | Add New User Group
High | Allow Export
High | Allow Recopy Data in Media
High | Allow Recopy Job
High | Certificate Change
High | Change Network Password
High | Change Storage Policy Copy Data Path
High | Change Subclient Content
High | Control Services
High | Create Case Definition
High | Create Subclient
High | Data Cube Delete Data
High | Data Cube Delete Datasource
High | Data Cube Delete Field
High | Data Cube Delete Handler
High | Deconfigure Instance
High | Delete Case Definition
High | Delete dashboard search
High | Delete Instance
High | Delete Network Topology
High | Delete Replication Pair
High | Delete search
High | Delete Snap Volume Unit
High | Delete Subclient
High | Delete Subclient Policy
High | Delete Virtual Server Proxy
High | Delete Workflow
High | Deleted Schedule Holiday
High | Disable Schedule Policy
High | Disallow Content Indexing for Jobs
High | Do Not Retain Job
High | Execute QScript
High | Migrate Disk Library
High | Move Partition Access Path Update Failure
High | Move Partition Failure
High | Reach Destination for Media in VaultTracker Action
High | Reassociate Bulk Subclients
High | Reassociate Individual Subclients
High | Reassociate Subset of Subclients
High | Reference Copy Association
High | Reference Copy Content
High | Resume Export for Media in VaultTracker Action
High | Return Media in VaultTracker Action to Source
High | Rollback History of VaultTracker Action
High | Scheduled job ran
High | SearchAdmin Add Preference
High | SearchAdmin Delete Preference
High | SearchAdmin Modify Preference
High | Suspend Export for Media in VaultTracker Action
High | Tape Catalog Merge
High | Update Activity Control
High | Update Case
High | Update Client Encryption Properties
High | Update Content Indexing Properties for Storage Policy
High | Update Deduplication Access Path
High | Update Instance Properties
High | Update Library Properties
High | Update Storage Policy Properties
High | Update Subclient Properties
High | Update User group Associated Entities
High | Update User group capabilities
High | Update User Group properties
High | Update VaultTracker Policy
High | User Account Management
High | User group Enable/Disable
Medium | Add a Deduplication Access Path
Medium | Add a Mount Path
Medium | Add Blackout Window
Medium | Add Blind Media
Medium | Add Custom Calendar
Medium | Add File Server
Medium | Add Media Barcode Pattern
Medium | Add New Media Container
Medium | Add Snap Volume Unit
Medium | Add Spare Group
Medium | Add Subclient Policy
Medium | Add Workflow
Medium | Allow Content Indexing for Jobs
Medium | Allow Copy Job
Medium | Allow Copy Jobs in Media
Medium | Backup code generated
Medium | Backup code used
Medium | Change Default Datapath
Medium | Change Index Cache Retention Days
Medium | Change Media Barcode Pattern
Medium | Change SAN Switch
Medium | Change Storage Policy Copy Precedence
Medium | Change Storage Policy Properties for Deferred Cataloging
Medium | Change Storage Policy Properties for Moving Snapshots to back up Media.
Medium | Change Subclient Post-Command
Medium | Change Subclient Pre-Command
Medium | Change the Host for a Storage Node in Expert Storage Configuration Tool
Medium | Change Threshold for Drive Maintenance
Medium | Change Threshold for Library
Medium | Change Threshold for Media Expiration
Medium | Changed Filer Management
Medium | Changed Schedule Holiday
Medium | Client Configuration Policy Modified
Medium | Client user profile Operation
Medium | Clone Content Director Legal Hold
Medium | Clone Content Director Policy
Medium | Clone Content Director Record Center
Medium | Clone Content Director Search
Medium | Clone Content Director Tag
Medium | Clone ERM Connector
Medium | Clone Storage Policy
Medium | Clone Subclient Policy
Medium | Command-line Login Failed
Medium | Command-line Logout Failed
Medium | CommCell Readiness Check
Medium | Configure a Storage Node in Expert Storage Configuration Tool
Medium | Configure library server
Medium | Configure the Whole Storage Node in Expert Storage Configuration Tool
Medium | Create Content Director Legal Hold
Medium | Create Content Director Policy
Medium | Create Content Director Record Center
Medium | Create Content Director Search
Medium | Create Content Director Tag
Medium | Create Content Indexing for Storage Policy
Medium | Create dashboard search
Medium | Create ERM Connector
Medium | Create metrics alert
Medium | Create New Backup set
Medium | Create New Client Group
Medium | Create New Instance
Medium | Create Office365 Custom Category
Medium | Create Region
Medium | Create Replication Group
Medium | Create Schedule
Medium | Create Schedule Policy
Medium | Create search
Medium | Create Share Folder Operation
Medium | Create SIEM connector
Medium | Create Storage Policy
Medium | Create Storage Policy Copy
Medium | Create Sync Folder Operation
Medium | Created Array Management entry
Medium | Created Filer Management
Medium | Created Schedule Holiday
Medium | Data Cube MetaInfo
Medium | Data Cube Update Datasource
Medium | Data Cube Update Handler
Medium | Data Cube Update Schema
Medium | Data UnAging
Medium | Delete Blackout Window
Medium | Delete Media Barcode Pattern
Medium | Delete Region
Medium | Delete SIEM connector
Medium | Delete webhook
Medium | Deleted Array Management entry
Medium | Deprecated message.
Medium | Description modified
Medium | Disable Alert
Medium | Disable Content Director Legal Hold
Medium | Disable Content Director Policy
Medium | Disable Content Director Record Center
Medium | Disable Content Director Search
Medium | Disable Content Director Tag
Medium | Disable Deduplication Access Path
Medium | Disable ERM Connector
Medium | Disable metrics alert
Medium | Disable Schedule
Medium | Disable Workflow
Medium | Discover Media
Medium | Drive Cleaned
Medium | Drive Replaced
Medium | Edge Drive Operation
Medium | Edit Network Topology
Medium | Edit Syslog configuration
Medium | Edit Virtual Server Proxy
Medium | Edited Array Management entry
Medium | Enable Alert
Medium | Enable Content Director Legal Hold
Medium | Enable Content Director Policy
Medium | Enable Content Director Record Center
Medium | Enable Content Director Search
Medium | Enable Content Director Tag
Medium | Enable Deduplication Access Path
Medium | Enable ERM Connector
Medium | Enable metrics alert
Medium | Enable Schedule
Medium | Enable Schedule Policy
Medium | Enable Workflow
Medium | Execute QScript
Medium | Export Media
Medium | Export Media from Library
Medium | Export Media from Library through VaultTracker
Medium | Export Media through VaultTracker
Medium | Export set deleted
Medium | Kill Job
Medium | Laptop Activation
Medium | Laptop Deactivation
Medium | Login Failed
Medium | Mark Media Bad
Medium | Mark Media from Foreign CommCell Reusable
Medium | Mark Media Full
Medium | Mark Media Good
Medium | Mark Partial Full
Medium | Mark Volume Full for Storage Policy Copy
Medium | Media Reuse Allowed
Medium | Media Reuse Prevented
Medium | Migrate Media
Medium | Modify alerts subscription preference.
Medium | Modify dashboard search
Medium | Modify MediaAgent properties
Medium | Modify metrics alert
Medium | Modify Network Route Configuration
Medium | Modify Office365 Custom Category
Medium | Modify search
Medium | Modify SIEM connector
Medium | Modify webhook
Medium | Mount Snapshot
Medium | Move All Media to Spare Group
Medium | Move Number of Media to Spare Group
Medium | Pick Job for Data Verification
Medium | Pick Job for Moving Snapshots to back up Media
Medium | Pick up Media in VaultTracker Action
Medium | Prevent Export
Medium | Rename Case
Medium | Rename Snap Volume Unit
Medium | Rename Spare Group
Medium | Rename Subclient
Medium | Rename Subclient Policy
Medium | Rename Workflow
Medium | Report Search Analytic Engine
Medium | Restore Contents
Medium | Retain Job
Medium | SamlToken Generated
Medium | SamlToken Validated
Medium | Security Domain Settings
Medium | Share Folder Operation
Medium | Share Mount Path
Medium | Suspend Job
Medium | Sync Folder Operation
Medium | Unmount Snapshot
Medium | Unpick Job for Moving Snapshots to back up Media
Medium | Update Application properties
Medium | Update Backup set properties
Medium | Update Blackout Window
Medium | Update Case Definition
Medium | Update client group properties
Medium | Update Client properties
Medium | Update Client properties - Client group association
Medium | Update Content Director Legal Hold
Medium | Update Content Director Policy
Medium | Update Content Director Record Center
Medium | Update Content Director Search
Medium | Update Content Director Tag
Medium | Update Deduplication Properties
Medium | Update ERM Connector
Medium | Update Export Location
Medium | Update Instance properties
Medium | Update Iron Mountain Customer ID
Medium | Update local authentication configuration
Medium | Update Media Barcodes
Medium | Update Media Container
Medium | Update Media Management Configuration Parameter
Medium | Update Media Properties
Medium | Update Region Properties
Medium | Update Report Subscriptions
Medium | Update Schedule
Medium | Update Schedule Policy
Medium | Update Service Commcell Security Association
Medium | Update Share Folder Operation
Medium | Update Snap Volume Unit
Medium | Update Spare Group Properties
Medium | Update Subclient Policy
Medium | Update Subclient properties
Medium | Update Sync Folder Operation
Medium | Update User
Medium | Update User group association
Medium | Update Workflow
Medium | Updated Device Path Properties
Medium | User Disconnect
Medium | Verify Media
Medium | Web Service Login Failure
Low | A SCSI2 reservation was released for a drive, and the reservation release was successful.
Low | Add Command
Low | Add Export Location
Low | Add Iron Mountain Customer ID
Low | Add Media Container
Low | Add Network Topology
Low | Add Virtual Server Proxy
Low | Add web authenticator
Low | Annotation
Low | Automatic Client Group Update
Low | Blind Media Full Inventory
Low | Blind Media Quick Inventory
Low | Browse/Find Operation
Low | Command-line Internal Login
Low | Command-line Login
Low | Command-line Logout
Low | Command-line Pseudo Login
Low | Compliance Search
Low | Configure Data Interface Pair
Low | Delete Backup and Archive Data
Low | Delete Command
Low | Delete Data Interface Pair
Low | Download center operation
Low | Download Item
Low | Download process from the end user compliance page.
Low | Dummy Operation - please replace.
Low | Edit Data Interface Pair
Low | ERM Submission
Low | Execute QScript
Low | Export Client Pass Phrase
Low | Full Library Scan
Low | Global Filer Added
Low | Global Filer Deleted
Low | Global Filer Modified
Low | Immediate Job Submitted
Low | Index Server Changed
Low | Laptop Activation
Low | Laptop Deactivation
Low | Legal Hold Item
Low | Mark Drive Fixed
Low | Mark Media Exported
Low | Media Catalog
Low | Modify Command
Low | Move Partition Access Path Update Success
Low | Move Partition Success
Low | Printing
Low | Push Network Configuration
Low | Quick Library Scan
Low | Remove web authenticator
Low | Reset Client Pass Phrase
Low | REST API Failure
Low | Review Set Operation
Low | SAML test login attempted
Low | Set Container for Media in VaultTracker Action
Low | Table Filter Modified
Low | Tagging
Low | Trying to delete a Storage Policy Copy which has Compliance Lock enabled.
Low | Trying to delete a Storage Policy which has Compliance Lock enabled on its Primary Copy.
Low | Trying to lower Basic or Extended Retention on a copy which has Compliance Lock enabled.
Low | User Logged in
Low | User Logged out
Low | Web Console download Operation
Low | Web Service Login

×

Loading...