Autodesk Vault IIS Logs

[carlos.arredondo]

Hello everyone,
A Vault Change Order was deleted from the system. I need to know who has deleted the order, and I'm searching in IIS logs. You can notice that an ECO was deleted, but you can't know who done it.
The following image shows a part of the log where it displayed that an ECO was deleted. Now, how can I know who done it and which ECO?

I also attach the log file with all information.
Thank you for your valuable help.

[minkd]

The IIS log entry shows uid=2 in the query string.

The first couple of user IDs are established during initial installation for users such as Administrator and Guest.  However, only the Administrator role has the permission to delete change orders.

Therefore, it is highly likely the person who deleted the CO used the Administrator account to do it.

You can narrow it down to what client host was used by looking at the c-ip (client IP address) column of the IIS log.

-Dave

[jeamy.baena]

Greetings, Dave

ok, We can locate the IP address and know the username (asumming there is a only one user in this machine..) , but, is there a way to know the deleted ECO name? Vault console already do that for files but not for ECOs..

Thanks!

[minkd]

I'm not aware of any way to determine the name of a deleted ECO.

-Dave