# How the audit graphic objects work

Audit trail list shows the information about operator actions at run time, including:

- Occurred time - The local date and time when the software product records the action as having occurred.
- Source - The name of the software product that logged the action in the audit log.
- Location - The name of the computer, Windows CE device, or MobileView terminal on which the action took place.
- Resource - Reserved
- Username - The login ID of the user who is using the software product. This can be a FactoryTalk Security user or a Microsoft Windows user, depending on how the user logged into the software product that generated the audit record.
- Message - Information about a specific operator action executed within the context of the running runtime application. For example, the message for a tag write will include the tag being modified, and the tag’s previous and new values.

Audit trail detail object shows the information about the selected audit entry on an audit trail list.

When a display containing an audit trail list object is opened, the highlight bar is on the most recent audit message at the top of the list. As new audit messages come in, the old messages scroll down, but the indicator remains at the top. If the highlight bar on the object is not at the top of the list, for example, the operator selects an audit message other than the top one in the list, the list will not scroll down when new messages come in. Therefore, the new audit will not automatically appear at the top of the list.