Use the Audit Log Viewer to view the audit log of internal Symantec ESM events. After enabling the audit log for a specific ESM manager, you can view the internal Symantec ESM events related to that manager in the Audit Log Viewer. The Audit Log Viewer helps you ensure that users do not make unauthorized changes or connections.

You can view internal Symantec ESM events by user account, by the unique connection identifier, or by the time and date of the event. You can also use more than one item as criteria for displaying the event. For example, you can configure the viewer to display any internal Symantec ESM events that were logged for user account Mark on May 6, 2007 between 6:00 A.M. and 6:00 P.M.