Bottom line: Choose basic word search or advanced filtering before composing the audit query. Confirm the active mode and the separate service selection so an absent field option is investigated in the right interface context.
\nThe TrueNAS 25.10 Audit screen reference says Switch to Advanced replaces the default basic search with advanced search. Basic mode is a simple word search, and clicking its Search field does not display search-filter options. Advanced mode accepts filter parameters to narrow the record type, and clicking the Search field displays its advanced filter options. Switch to Basic returns the search operation to the default simple word-search method. The separate Service dropdown selects a service population; with no service selected, entries from all services are displayed.
\nThis article chooses the documented search interface and record population, not a universal audit-query grammar. It does not establish complete logging or retention, prescribe undocumented operators or infer that an absent result proves an event never occurred.
\nThe following steps are DSE recommendations based on the cited source.
\nDSE recommends writing the investigation question before entering text. For a proposed keyword lookup, choose one non-sensitive word associated with a known harmless record. For a proposed field-filtered question, identify the record property that should express the requirement. Keep those two proposed queries separate rather than pasting an unfamiliar filter expression into whichever field is visible.
\nInspect the current mode control before investigating missing field options. Ask the operator to record the displayed mode and the intended query type. If basic search is selected, decide whether a word lookup meets the question or whether the advanced workflow is needed. Avoid changing audit collection settings merely because the current search field offers no parameter choices.
\nFor the advanced case, inspect the options actually offered by the installed interface. Select only fields and values supported by that workflow and its applicable documentation. Preserve a redacted view of the chosen controls so another administrator can reconstruct the intended query. Do not invent an operator, wildcard or exact-match syntax from an unrelated logging product.
\nReview the Service dropdown independently of the search mode. Name the intended service population and have the investigator approve it before running the query. When switching back to basic mode, review the query again instead of assuming that a previously entered advanced expression remains meaningful. Keep any resulting export as secondary evidence of the accepted search, rather than the reason for selecting a mode.
\nProposed verification: use a known harmless audit record in an approved test arrangement. Record its available identity and a non-sensitive search word. Inspect the basic-mode controls, run the permitted word lookup and compare the actual result with that known record. Preserve an unexpected absence for investigation without changing collection policy.
\nSwitch to the advanced workflow, inspect its offered field options and construct the separately approved query through those controls. Compare the same record under the intended Service selection. Then switch back and inspect the displayed mode before another word lookup. Retain the actual controls, redacted query and observations; do not claim that these proposed checks have run or that one successful search establishes complete audit coverage.
\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.
\n", "content_text": "Bottom line: Choose basic word search or advanced filtering before composing the audit query. Confirm the active mode and the separate service selection so an absent field option is investigated in the right interface context.\nSource fact: what the authority says\nThe TrueNAS 25.10 Audit screen reference says Switch to Advanced replaces the default basic search with advanced search. Basic mode is a simple word search, and clicking its Search field does not display search-filter options. Advanced mode accepts filter parameters to narrow the record type, and clicking the Search field displays its advanced filter options. Switch to Basic returns the search operation to the default simple word-search method. The separate Service dropdown selects a service population; with no service selected, entries from all services are displayed.\nWhat the source does not establish\nThis article chooses the documented search interface and record population, not a universal audit-query grammar. It does not establish complete logging or retention, prescribe undocumented operators or infer that an absent result proves an event never occurred.\nApplicability questions\n\nIs the intended question a simple word lookup or a field-filtered search?\nWhich search mode is actually active?\nWhat filter options does this installed interface offer?\nWhich service population and known harmless record belong in the comparison?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends writing the investigation question before entering text. For a proposed keyword lookup, choose one non-sensitive word associated with a known harmless record. For a proposed field-filtered question, identify the record property that should express the requirement. Keep those two proposed queries separate rather than pasting an unfamiliar filter expression into whichever field is visible.\nInspect the current mode control before investigating missing field options. Ask the operator to record the displayed mode and the intended query type. If basic search is selected, decide whether a word lookup meets the question or whether the advanced workflow is needed. Avoid changing audit collection settings merely because the current search field offers no parameter choices.\nFor the advanced case, inspect the options actually offered by the installed interface. Select only fields and values supported by that workflow and its applicable documentation. Preserve a redacted view of the chosen controls so another administrator can reconstruct the intended query. Do not invent an operator, wildcard or exact-match syntax from an unrelated logging product.\nReview the Service dropdown independently of the search mode. Name the intended service population and have the investigator approve it before running the query. When switching back to basic mode, review the query again instead of assuming that a previously entered advanced expression remains meaningful. Keep any resulting export as secondary evidence of the accepted search, rather than the reason for selecting a mode.\nVerification and evidence\nProposed verification: use a known harmless audit record in an approved test arrangement. Record its available identity and a non-sensitive search word. Inspect the basic-mode controls, run the permitted word lookup and compare the actual result with that known record. Preserve an unexpected absence for investigation without changing collection policy.\nSwitch to the advanced workflow, inspect its offered field options and construct the separately approved query through those controls. Compare the same record under the intended Service selection. Then switch back and inspect the displayed mode before another word lookup. Retain the actual controls, redacted query and observations; do not claim that these proposed checks have run or that one successful search establishes complete audit coverage.\nOfficial references\n\nTrueNAS — Audit Screen — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "content_markdown": "Bottom line: Choose basic word search or advanced filtering before composing the audit query. Confirm the active mode and the separate service selection so an absent field option is investigated in the right interface context.\n\n## Source fact: what the authority says\n\nThe [TrueNAS 25.10 Audit screen reference](https://www.truenas.com/docs/scale/25.10/scaleuireference/systemsettings/auditscreen/) says Switch to Advanced replaces the default basic search with advanced search. Basic mode is a simple word search, and clicking its Search field does not display search-filter options. Advanced mode accepts filter parameters to narrow the record type, and clicking the Search field displays its advanced filter options. Switch to Basic returns the search operation to the default simple word-search method. The separate Service dropdown selects a service population; with no service selected, entries from all services are displayed.\n\n## What the source does not establish\n\nThis article chooses the documented search interface and record population, not a universal audit-query grammar. It does not establish complete logging or retention, prescribe undocumented operators or infer that an absent result proves an event never occurred.\n\n## Applicability questions\n\n- Is the intended question a simple word lookup or a field-filtered search?\n\n- Which search mode is actually active?\n\n- What filter options does this installed interface offer?\n\n- Which service population and known harmless record belong in the comparison?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends writing the investigation question before entering text. For a proposed keyword lookup, choose one non-sensitive word associated with a known harmless record. For a proposed field-filtered question, identify the record property that should express the requirement. Keep those two proposed queries separate rather than pasting an unfamiliar filter expression into whichever field is visible.\n\nInspect the current mode control before investigating missing field options. Ask the operator to record the displayed mode and the intended query type. If basic search is selected, decide whether a word lookup meets the question or whether the advanced workflow is needed. Avoid changing audit collection settings merely because the current search field offers no parameter choices.\n\nFor the advanced case, inspect the options actually offered by the installed interface. Select only fields and values supported by that workflow and its applicable documentation. Preserve a redacted view of the chosen controls so another administrator can reconstruct the intended query. Do not invent an operator, wildcard or exact-match syntax from an unrelated logging product.\n\nReview the Service dropdown independently of the search mode. Name the intended service population and have the investigator approve it before running the query. When switching back to basic mode, review the query again instead of assuming that a previously entered advanced expression remains meaningful. Keep any resulting export as secondary evidence of the accepted search, rather than the reason for selecting a mode.\n\n## Verification and evidence\n\nProposed verification: use a known harmless audit record in an approved test arrangement. Record its available identity and a non-sensitive search word. Inspect the basic-mode controls, run the permitted word lookup and compare the actual result with that known record. Preserve an unexpected absence for investigation without changing collection policy.\n\nSwitch to the advanced workflow, inspect its offered field options and construct the separately approved query through those controls. Compare the same record under the intended Service selection. Then switch back and inspect the displayed mode before another word lookup. Retain the actual controls, redacted query and observations; do not claim that these proposed checks have run or that one successful search establishes complete audit coverage.\n\n## Official references\n\n- [TrueNAS — Audit Screen](https://www.truenas.com/docs/scale/25.10/scaleuireference/systemsettings/auditscreen/) — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/", "url": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-29" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Choose the TrueNAS audit search mode before composing a query", "item": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/#article", "identifier": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/", "url": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/", "headline": "Choose the TrueNAS audit search mode before composing a query", "description": "Distinguish basic word search from advanced field-filter mode before entering an audit query.", "abstract": "Distinguish basic word search from advanced field-filter mode before entering an audit query. Inspect the actual offered options and keep the separate Service selection explicit.", "articleBody": "Bottom line: Choose basic word search or advanced filtering before composing the audit query. Confirm the active mode and the separate service selection so an absent field option is investigated in the right interface context.\nSource fact: what the authority says\nThe TrueNAS 25.10 Audit screen reference says Switch to Advanced replaces the default basic search with advanced search. Basic mode is a simple word search, and clicking its Search field does not display search-filter options. Advanced mode accepts filter parameters to narrow the record type, and clicking the Search field displays its advanced filter options. Switch to Basic returns the search operation to the default simple word-search method. The separate Service dropdown selects a service population; with no service selected, entries from all services are displayed.\nWhat the source does not establish\nThis article chooses the documented search interface and record population, not a universal audit-query grammar. It does not establish complete logging or retention, prescribe undocumented operators or infer that an absent result proves an event never occurred.\nApplicability questions\n\nIs the intended question a simple word lookup or a field-filtered search?\nWhich search mode is actually active?\nWhat filter options does this installed interface offer?\nWhich service population and known harmless record belong in the comparison?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends writing the investigation question before entering text. For a proposed keyword lookup, choose one non-sensitive word associated with a known harmless record. For a proposed field-filtered question, identify the record property that should express the requirement. Keep those two proposed queries separate rather than pasting an unfamiliar filter expression into whichever field is visible.\nInspect the current mode control before investigating missing field options. Ask the operator to record the displayed mode and the intended query type. If basic search is selected, decide whether a word lookup meets the question or whether the advanced workflow is needed. Avoid changing audit collection settings merely because the current search field offers no parameter choices.\nFor the advanced case, inspect the options actually offered by the installed interface. Select only fields and values supported by that workflow and its applicable documentation. Preserve a redacted view of the chosen controls so another administrator can reconstruct the intended query. Do not invent an operator, wildcard or exact-match syntax from an unrelated logging product.\nReview the Service dropdown independently of the search mode. Name the intended service population and have the investigator approve it before running the query. When switching back to basic mode, review the query again instead of assuming that a previously entered advanced expression remains meaningful. Keep any resulting export as secondary evidence of the accepted search, rather than the reason for selecting a mode.\nVerification and evidence\nProposed verification: use a known harmless audit record in an approved test arrangement. Record its available identity and a non-sensitive search word. Inspect the basic-mode controls, run the permitted word lookup and compare the actual result with that known record. Preserve an unexpected absence for investigation without changing collection policy.\nSwitch to the advanced workflow, inspect its offered field options and construct the separately approved query through those controls. Compare the same record under the intended Service selection. Then switch back and inspect the displayed mode before another word lookup. Retain the actual controls, redacted query and observations; do not claim that these proposed checks have run or that one successful search establishes complete audit coverage.\nOfficial references\n\nTrueNAS — Audit Screen — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "datePublished": "2026-10-29T20:33:01+00:00", "dateModified": "2026-10-29T20:33:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-the-truenas-audit-search-mode-before-composing-a-query/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose the TrueNAS audit search mode before composing a query" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 606, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "TrueNAS — Audit Screen", "url": "https://www.truenas.com/docs/scale/25.10/scaleuireference/systemsettings/auditscreen/" } } ] } }