Intel AMT Features > Access Monitor > Use Cases > Get the Audit Log State
CollapseAll image

Get the Audit Log State


To ensure you retrieve the correct information, Intel recommends that you lock the audit log while you are performing this procedure (see Lock and Unlock the Audit Log).

The following steps describe how to retrieve the Audit Log state and additional informative data.

1.  Retrieve the instance of AMT_AuditLog, where the “Name” key equals “Intel(r) AMT:Audit Log”.

2.  Examine the AMT_AuditLog.AuditState property value to determine the audit log state.

3.  Examine the following properties to retrieve additional data:




Click here for a snippet demonstrating this step

See the General Info Get Core Version use case for the GetCoreVersion function.

You can execute this snippet by inserting it into the execution template found here.


$auditLogRef =$wsmanConnectionObject.NewReference("SELECT * FROM AMT_AuditLog WHERE Name='Intel(r) AMT:Audit Log'")

$auditLogInstance =$auditLogRef.Get()

$auditState =$auditLogInstance.GetProperty("AuditState")

$percentageFree =$auditLogInstance.GetProperty("PercentageFree")

$currentNumberOfRecords =$auditLogInstance.GetProperty("CurrentNumberOfRecords")

$maxAllowedAuditors =$auditLogInstance.GetProperty("MaxAllowedAuditors")

$timeOfLastRecord =$auditLogInstance.GetProperty("TimeOfLastRecord")

$fwVersion = GetCoreVersion

if($fwVersion.ToString() -ge "5.1")


    $timeOfLastRecord =$timeOfLastRecord.InternalObject.Text




Instance Diagram

Classes Used in This Flow


SDK Sample

If there is a sample demonstrating this flow, it is included in the SDK installation file. See SDK Installation Layout for details.


See Also:

   Reading the Audit LogView the Audit Policy Details

Copyright © 2006-2022, Intel Corporation. All rights reserved.