How to find which user deleted the entries in the Active list in ESM


there is a scenario where entries in Active list erased. I would like to know who/how entries were deleted in Active List in ESM

Can some one help me on this is there a way to find the details about how or who has erased the Active list entries.

Thanks in advance!!

  • Hello Akshay,

    Look for the following events:

    Device Event Class ID: activelist:102

    Name: ActiveList entry deleted

    This are internal events generated by the Manager Internal Agent and they are triggered when an active list entry is deleted.

    Namely, in those events you will find additional information such as:

    File Name: <name of your active list>

    File Path: <path to your active list>

    Target User Name and Target User ID: <information about the user who deleted the entry, if it was a user that did it>

    Otherwise check the events and see what other pieces of information are valuable to your scenario.

    All the best,


  • Hi

    How to retrieve the clear entries from any active list.