How to find user and insight events of the Exploratory Server.

From version 8.0 of the Exploratory Server, you can find the user and insight events in the log file. It includes the following events.

When/What user is created, updated or deleted.
When/what insight such as Dashboard, Note, Chart, etc is published, viewed, republished, or deleted.

It describes how to find those events and describes the event details.

Find events.

Those events are recorded in the log file of the exploratory container. Here is how to find the events.

Run the docker ps command. It lists all the running Docker containers like the following.
Look for the image starting with exploratory and check the CONTAINER_ID value. In this example, f590ee2ef600.
Find the log file. The log file is usually located at the following location. Replace the part with an actual file/folder name starting with the CONTAIER_ID found above.
```
/var/lib/docker/containers/<CONTAIER_ID>/<CONTAIER_ID>-json.log
```

Extract the events from the log file. All events contain [EVENT] text so you can grep the log file with this keyword.

cat /var/lib/docker/containers/<CONTAIER_ID>/<CONTAIER_ID>-json.log | grep -F "[EVENT]"

It will show events like the following with timestamps and other info.

[EVENT][VIEW][NOTE][ID:Sales-Report-mLU7xjp3Ut][BY:-]
[EVENT][ADD][DASHBOARD][ID:Sales-Dashbaord-WzY1boK0LE][BY:bob@example.com]
[EVENT][VIEW][DASHBOARD][ID:Sales-Dashbaord-WzY1boK0LE][BY:bob@example.com]
[EVENT][VIEW][VIZ][ID:Inventory-Chart-IyV9bCS3Bu][BY:bob@example.com]
[EVENT][ADD][USER][EMAIL:john@example.com][BY:-]
[EVENT][UPDATE][USER][EMAIL:john@example.com][BY:siteadmin@example.com]

How to read events.

The basic event syntax is the following.

   [EVENT][<Event Type>][<Event Target>][<Target ID>][<Initiated By>]

Event Type: Either of the following.
- ADD
- VIEW
- UPDATE
- DELETE
Event Target: Either of the following.
- DATA
- CHART
- ANALYTICS
- NOTE
- DASHBOARD
- DICTIONARY
- PROJECT
- USER
- TEAM
Target ID: ID of the Event Target. Either of the following.
- ID
- EMAIL - In case the event target is "USER".
Initiated By: Person who initiated the event. It should be a user's email, or "-" if a guest user initiated it.

Please take a look at the following for details.

Insight events.

The example of insight events looks like the following.

[EVENT][ADD][DASHBOARD][ID:Sales-Dashbaord-WzY1boK0LE][BY:bob@example.com]
[EVENT][UPDATE][DASHBOARD][ID:Sales-Dashbaord-WzY1boK0LE][BY:bob@example.com]
[EVENT][VIEW][VIZ][ID:Inventory-Chart-IyV9bCS3Bu][BY:bob@example.com]
[EVENT][VIEW][NOTE][ID:Sales-Report-mLU7xjp3Ut][BY:-]

Each insight event contains either of the following event types in the Event Type field.

ADD - New publish
VIEW - View it on a web browser.
UPDATE - Republish, restore, etc.
DELETE

Each insight event contains either of the following event targets at the Event Target field.

DATA
CHART
ANALYTICS
NOTE
DASHBOARD
DICTIONARY
PROJECT

Each insight event contains the insight ID of the event target in the ID field. It will be shown in the URL if you access the insight.

Each insight event contains who initiated the event in the Initiated By field. It will be a user's email, or "-" if a guest initiated. For example, if a guest user views a public dashboard, it will be '-'.

User/team events.

The example of user/team events looks like the following.

[EVENT][ADD][USER][EMAIL:john@example.com][BY:-]
[EVENT][UPDATE][USER][EMAIL:john@example.com][BY:siteadmin@example.com]
[EVENT][ADD][TEAM][ID:sales-team][BY:siteadmin@example.com]
[EVENT][UPDATE][TEAM][ID:sales-team][BY:siteadmin@example.com]

Each user/team event contains either of the following event types in the Event Type field.

ADD - Create a new user or team. For a user case, it records when a user activates an account by clicking the confirmation button.
UPDATE - Update a new user or team.
DELETE - Delete a new user or team.

Each user/team event contains either of the following event targets in the Event Target field.

USER
TEAM

Each user event contains the email address of the event target user. Each user event contains the team ID of the event target team.

Each user/team event contains who initiated the event in the Initiated By field. It will be an initiator's email address. It could be "-" for a new user creation event because when a user activates an account, the user is not logged in because the account is not created yet.