/api/2.0/fo/activity_log/?action=list
[GET] [POST]
Export the user activity log for a subscription to CSV format.
Parameter |
Description |
action=list |
(Required) |
user_action={value} |
(Optional) You can filter the output based on the actions. For example, login (for user login), launch (for scan launched), finished (for scan finished), etc. The actions which are included in the output depend on the user who runs the API. Managers see all actions taken by all users. Unit Managers see actions taken by users in their business unit. Scanners and Readers see their own actions only. |
action_details={value} |
(Optional) Filter on further information about the user actions. For example, for the action “error”, you can filter by the error details “No connection from scanner appliance”. |
username={value} |
(Optional) The name of the user who performed the action. Usernames are included in the output only if the user running the API is a Manager or a Unit Manager. A Unit Manager can see usernames only for users in the Unit Manager’s hierarchy. |
since_datetime={value} |
(Optional) Specify the date to include the activity log starting from that point in time. Date must be in the format YYYY-MM-DD HH:ii:ss, and must be less than or equal to today’s date. |
until_datetime={value} |
(Optional) Specify the date to include the activity log until a specific point in time. Date must be in the format YYYY-MM-DD HH:ii:ss, and must be more than or equal to since_datetime, and less than or equal to today’s date. |
user_role={value} |
(Optional) A Manager or Unit Manager can choose to export logs for certain user roles instead of all user roles. Specify this parameter to export logs for users with certain user roles. Multiple roles are comma separated. User roles you can specify: Manager, Unit Manager, Auditor, Scanner, Reader, KnowledgeBase Only, Remediation User, Contact What logs are exported by default? For a Manager logs are exported for all users (all user roles) by default. For a Unit Manager logs are exported only for users (all user roles) in the Unit Manager’s hierarchy (i.e. business unit). |
output_format=CSV |
(Optional) CSV (default) |
truncation_limit={value} |
(Optional) Limit the number of log records to include in the CSV output. |
API request
curl -u "username:password" -H "X-Requested-With:curl" "https://qualysapi.qualys.com/api/2.0/fo/activity_log/?action=list"
CSV output
"Date","Action","Module","Details","User Name","User Role","User IP"
"2017-02-03T04:35:38Z","login","auth","user_logged in","saand_rn","Manager","10.113.195.136"
"2017-02-02T13:58:16Z","login","auth","user_logged in","saand_rn","Manager","10.113.195.136"
"2017-02-02T13:48:07Z","request","auth","API: /api/2.0/fo/activity_log/index.php","saand_rn","Manager","10.113.195.136"
"2017-02-02T13:31:19Z","request","auth","API: /api/2.0/fo/activity_log/index.php","saand_rn","Manager","10.113.195.136"
"2017-02-02T13:28:38Z","request","auth","API: /api/2.0/fo/activity_log/index.php","saand_rn","Manager","10.113.195.136"
"2017-02-02T13:28:17Z","request","auth","API: /api/2.0/fo/activity_log/index.php","saand_rn","Manager","10.113.195.136"
"2017-02-02T13:27:27Z","request","auth","API: /api/2.0/fo/activity_log/index.php","saand_rn","Manager","10.113.195.136"
"2017-02-02T13:26:41Z","request","auth","API: /api/2.0/fo/activity_log/index.php","saand_rn","Manager","10.113.195.136"
"2017-02-02T12:52:43Z","set","host_attribute","comment=[vvv] for 11.11.11.4","saand_rn","Manager","10.113.14.208"
"2017-02-02T12:52:43Z","add","option","11.11.11.4 added to both VM-PC license","saand_rn","Manager","10.113.14.208"
"2017-02-02T12:50:32Z","create","network","New Network: 'abc'","saand_rn","Manager","10.113.14.208"