How can I track when data is exported from an instance?

[ners]

Hi,

Is there any way to track if a user is exporting data from an instance? The transaction logs give me lots of information but I'm struggling to pinpoint when the function of exporting to .csv, .xls or pdf is happening.

Appreciate any help...

[Albert13 · Accepted solution]

You can look in the event logs, sysevent table.  The event name is attachment.read, Param1 will tell you the file name and filter Param2 to sys_poll.  After that if you'really curious you can use the created and created by to match against the sys_attachment table to get the file.

[ners]

Thanks Albert,

That's worked perfectly for what I need