Audit trail

Last published : Aug 10, 2026
Related information

Overview

The audit trail feature allows to log all views access and user services launch in TIBCO EBX®.
The feature is disabled by default; to enable audit trail logging, configure the audit logging category with a level that enables INFO messages.
See also:

Log content

The information logged by audit trail comes in 2 parts: the common header and the event-specific content described in the following sections.

Common header

Here are the header attributes that are always logged:
user-login
Login of the user
user-ip
IP address of the user, when available
event
Type of event performed by the user, among the following value:
  • TABULAR_ACCESS: when a tabular view is accessed in the UI;
  • HIERARCHY_EXPAND_NODE: when a node is expanded in a hierarchical view, or when the view is displayed;
  • HIERARCHY_EXPAND_ALL: when several nodes are expanded in a hierarchical view;
  • DATASPACE_PERMISSION_TABULAR_ACCESS: when the permission table for a dataspace is accessed;
  • DATASET_PERMISSION_TABULAR_ACCESS: when the permission table for a dataset is accessed;
  • USER_SERVICE: when the export, compare, or validate built-in service, an addon or a custom user service is launched.

Table view events

This section describes the events specific to table views, which are:
  • TABULAR\_ACCESS
  • HIERARCHY\_EXPAND\_NODE
  • HIERARCHY\_EXPAND\_ALL
  • DATASPACE\_PERMISSION\_TABULAR\_ACCESS
  • DATASET\_PERMISSION\_TABULAR\_ACCESS
These events are triggered when the table view is opened or refreshed, when a search is performed and when the user navigates using pagination.
Here are the content attributes specific to these events:
dataspace
Key of the dataspace containing the table
dataset
Key of the dataset containing the table
table
Path of the table being accessed (does not apply to permission events)
view-id
Identifier of the custom view currently applied if any (does not apply to permission events)
view-name
Published name of the custom view currently applied if any (does not apply to permission events)
pagination-info
Information about the pagination of the tabular view or the expanded node
hierarchy-expanded-node
Identifier of the node being expanded (only applies to hierarchy events).
When several levels are expanded (search or expand all), it is the node on the higher level. The identifier is the node label prefixed by ":". The root node is identified as ":".
When a hierarchy is initially displayed, only the root node is expanded so the event is HIERARCHY_EXPAND_NODE.
filters
All filters applied to the view, aggregated in a JSON format. There are 3 kinds of filter:
  • quick-search: user input in the quick search field, if any;
  • structured-search: user advanced filters configured using the advanced search panel in a JSON format, if any;
  • view-filter: filter defined by the view in a XPath format, if any.
For instance: 
filters={"structured-search":["starts-with","/field/city","city"],"view-filter":"matches(./country,'France')"}

User service

Here are the content attributes specific to this event:
service-key
Service key of the service being executed
service-mode
A service can be executed on any intermediate level of the selection entity. For example, if the current selection entity is a record, then the service may be executed on the following levels: dataspace, dataset, table or a record. This attribute allows to define on which level of the selection entity the service is executed.
selection
Entity selection on which the service is executed (branch or version, dataset, etc.) in a JSON format. When more than 100 records are selected, only the 100th first records are logged.
service-parameters
Additional input parameters specified for the service execution :
  • for built-in services, see the list of parameters;
  • for custom services, the parameters are specified in the declaration;
  • for addon services, see the addon documentation.

Legacy XML Audit trail (deprecated)

XML audit trail logs data updates to XML files. This legacy feature, now deprecated, will be removed in a future version. Although this type of audit trail should no longer be used, the legacy documentation is still available.