Pre-Filtering the Audit Viewer Tool Window

The Audit Viewer Tool window displays the events tracked by the auditing function and provides access to all the auditing management functions in the system. These include selecting which fields to display in each event and deciding which events to exclude from the audit.

When accessing the window, you must first create a filter that reduces the number of events displayed to a manageable number and that do not unduly consume system resources.

1.  From the CARESTREAM PACS Admin Home Page, select Administration --> System Monitor --> Audit Trail.

The Filter Events window appears.

2.  Enter one or more filter criteria, as follows:

• Date Filter—filters events according to the date.

• Between—displays only those events that occurred between selected dates. Enter a date in the From Date and To Date fields (DD/MM/YYYY format). To use today's date as the start or end date, click Current date.

• Previous—displays only the events that occurred during a specified number of previous days. Enter a number in the field provided.

• Severity Filter—select the check box next to each event type to display, as follows:

 Information—events related to PHI accesses, such as a data query or a login.

 Warning—events that could affect the system, such as major configuration changes or start/stop operations (for example, stopping the Info Router). Any changes made to the list of events that are not audited, as described in Defining Audit Event Settings, are also considered warning events.

 Error—events that indicate any type of failure that affects the availability of the system.

 Success Audit—events such as successful logins to the system and other security-related matters.

 Failure Audit—events that indicate a security violation, such as an authentication failure (bad login) or an access control restriction violation attempt.

• Field Filter area—filters events according to information contained in selected fields, as follows:

• User Name—the name of the user who performed the action recorded by the event.

• Source—the source of the event, such as the Central Configuration.

• Location—the server on which the event occurred.

• Category—the event type, such as System Access or Account Management.

• Sub Category—the event subtype, such as User Authentication or Security Alert.

• Last Name—the patient’s last name.

• First Name—the patient’s first name.

NOTE: Partial entries and wildcards can be used in these fields.

3.  Click OK.

The selected filter criteria are applied and the Audit Viewer Tool window appears. See Audit Viewer Tool Window.

NOTE: To erase all currently defined filter criteria, click Clear.