User access log events in IEE

Monitoring user access is a common security requirement for IT departments. IEE provides secure, centralized monitoring of IEE Rich Client user access through a combination of log files, audit tables, and MSMQ events.

User access monitoring allows you to identify who is successfully accessing the IEE Rich Client, who has changed their login profile, and who attempted but failed to access the IEE Rich Client. IEE logs Rich Client user access events in the following locations.

Table 58 Locations

Event	Logging Location
Log in succeeded	MSMQ only
Log in failed	MSMQ and log file
Log off	MSMQ only
User account locked	MSMQ, log file, and audit table
User account unlocked	MSMQ and audit table
User account created	Audit table
User account deleted	Audit table
Password reset	MSMQ, log file, and audit table
Change in user master data	MSMQ and audit table

MSMQ user access event messages include the following information.

• The IP address of the computer that received the user action.

• The user ID that initiated the event.

• The event type, such as successful login or user account locked.

• The date and time of the event.

• For failed log in attempts, the reason for the failure.

User access event messages that are sent only to MSMQ are not stored in the IEE database.