Accessing and Exporting SIMATIC Logon Audit Trail Records Without Database Passwords

Accessing SIMATIC Logon internal database files (such as 'EventLogV2a.mdb') via Microsoft Access requires a confidential Siemens system password that is intentionally withheld to guarantee FDA 21 CFR Part 11 audit trail integrity. Directly opening or tampering with the underlying MDB file invalidates electronic signature compliance. To analyze, query, and export user login, logout, and operator authentication activity legally and safely, engineers must use the official SIMATIC Logon Event Log Viewer, which provides built-in tools to filter and export signed audit records to CSV, XML, or PDF.

Regulatory Security and Integrity of SIMATIC Logon Audit Trails

In regulated manufacturing environments (such as pharmaceuticals, biotechnology, and food production governed by FDA 21 CFR Part 11 and EU Annex 11), user authentication records constitute legal electronic audit trails.

SIMATIC Logon stores user authentication events—logins, logouts, failed password attempts, electronic signatures, and permission modifications—in local or central database files:
* In older and transition systems, these records reside in Microsoft Access database containers (e.g., EventLogV2a.mdb).
* To prevent unauthorized alteration, falsification, or manual deletion of security logs by local administrators or malicious actors, Siemens encrypts and password-protects the database container with an internal cryptographic key.
* Siemens Technical Support will never disclose this database password. Bypassing database passwords using third-party password recovery tools invalidates the plant's computer system validation (CSV) status and breaches regulatory compliance.

Approved Workflow: SIMATIC Logon Event Log Viewer

To perform security audits, shift reviews, or user activity tracking, Siemens provides the fully validated SIMATIC Logon Event Log Viewer:
1. Accessing the Utility:
* On the Engineering Station, OS Server, or computer hosting the SIMATIC Logon service, open the Windows Start menu.
* Navigate to Siemens Automation -> SIMATIC -> SIMATIC Logon -> Event Log Viewer.
2. User Authentication:
* Opening the Event Log Viewer requires authentication by an authorized user belonging to the Windows group Logon Administrator.
3. Reviewing Event Data:
* The viewer displays all chronological authentication records:
* Timestamp (UTC and Local).
* Computer Name.
* User Account ID and Full Name.
* Event Category (Logon, Logoff, Electronic Signature, Password Change).
* Result Status (Success, Failed, Denied).

Exporting and Analyzing Audit Data in CSV and XML Formats

Once filtered within the official viewer, data can be extracted for statistical analysis, reporting, or long-term cold storage:

Configure Search Filters:
* In the Event Log Viewer, click Filter.
* Define the evaluation window: specify start date/time, end date/time, specific user names, or target machine hostnames.
Execute File Export:
* Click the Export... button on the toolbar.
* Choose the target export format:
- CSV (Comma-Separated Values): Ideal for importing into Microsoft Excel or corporate security information and event management (SIEM) software.
- XML: Machine-readable structured format for automated database ingestion.
- PDF: Sealed, human-readable audit report for compliance inspectors.
Automating Centralized Archiving:
* For enterprise facilities, configure SIMATIC Logon to archive database segments automatically to a secure, write-protected network repository.

Verification

Launch SIMATIC Logon Event Log Viewer.
Verify that recent operator login and logout events populate the main grid with accurate timestamps.
Execute an export of the previous 30 days of activity to Audit_Log.csv.
Open the CSV file in a text editor or Excel. Confirm that all columns (Timestamp, Event, User, Status) are populated and formatted cleanly.

Limitations and Operational Precautions

Only users assigned to the Windows group Logon Administrator are permitted to open the Event Log Viewer or export audit records.
Never attempt to open EventLogV2a.mdb while the SIMATIC Logon service is running; concurrent access locks can corrupt active security logging.
In distributed systems, ensure that Windows time synchronization is calibrated across all stations; misaligned system clocks cause confusing out-of-sequence event timestamps.

Engineer FAQ

Can SIMATIC Logon export audit records automatically to a central SQL database?
Yes. Starting with SIMATIC Logon V1.6+, events can be logged directly into central Microsoft SQL Server instances or forwarded via Windows Event Logs to enterprise SIEM platforms.
What happens if the EventLog database file becomes full?
SIMATIC Logon features automated circular archiving. When the active file reaches size thresholds, it seals the file and creates a new sequential segment without data loss.
Can a user delete individual login records using the viewer?
No. To preserve regulatory compliance, the Event Log Viewer is strictly a read-only reporting tool; individual record deletion is architecturally impossible.

Technical References

SIMATIC Logon Administration and Operating Instructions (A5E41356305-AA).
FDA 21 CFR Part 11: Electronic Records; Electronic Signatures Guidelines.
Siemens Industry Online Support Entry ID 109801081: Exporting and Analyzing SIMATIC Logon Audit Trails.