| 1. Access EM |
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Audit Policy'
3. Select 'Oracle Platform Security Services' from the 'Audit Component Name' dropdown
4. Beneath 'Audit Policy Settings' section, ensure that the value 'Custom' is set in the 'Audit Level' dropdown
5. Beneath 'Audit Policy Settings' section, ensure that every checkbox is selected under the 'Select For Audit' column of the policy category table
6. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Logs' -> 'View Log Messages'
7. Within the 'Search' panel, expand 'Selected Targets'
8. Click 'Target Log Files' icon for any of the managed server or 'Application Deployment' type targets (not AdminServer)
9. From the list of log files, select '.log', 'access.log' or '-diagnostic.log' and click 'View Log File' button
10. User or process associated with audit event will be displayed in 'User' column
11. If 'User' column does not appear, use 'View' button -> 'Columns' list to add 'User' field, or select individual message in log message table and view the message detail (beneath the table)
12. Repeat steps 6-11 for each target
If the user is not part of the audit events, this is a finding.