The ARM captures the following transaction information:
Socket Connections
Timestamp
Remote IP
Remote Port
Local IP
Local Port
Site Name
Result
Authentication Operations
Timestamp
Remote IP
Remote Port
Local IP
Local Port
Protocol
Site Name
User name
Password Hash
Settings Level Membership
Group Membership
Result
Protocol Operations
Timestamp
Remote IP
Remote Port
Local IP
Local Port
Protocol
Site Name
Command / Operation
Result
File Name
Virtual Folder Name
Physical Folder Name
Bytes Transferred
Custom Command
Timestamp
Site Name
Command Name
Command Parameters (delimited in a single field)
Execution time
Result
Event Trigger
Timestamp
Site Name
Event Name
Event Type (file upload, monitor folder, etc.)
Matching Condition values, if there is a condition on the event. For example, the filename that matches a virtual path mask condition, or the folder that triggers a MONITOR FOLDER event.
Result
Transaction ID (unique)
Event Actions
Timestamp
Site Name
Event Name
Action Types such as move, copy, OpenPGP, and send e-mail.
Action Parameters - these are runtime values passed to the action, not the replacement variables.
Failed Action Flag - This is captured if this action is the result of a FAILURE sequence on a prior action.
Action Result Code
Result