Datto RMM Audit Data
Overview
Audit data in Datto RMM provides detailed hardware and software inventory for managed devices. The agent periodically collects this information and reports it to the platform. This skill covers accessing audit data, understanding its structure, and common audit workflows.
Anti-triggers
- Software observed running rather than software installed —
RocketCyber reports application telemetry from its own sensor; use
rocketcyber-apps.
- Whether the device is reachable right now — audit data is a
periodic snapshot and goes stale; use
datto-rmm-devices.
- Inventory as documentation of record — use
itglue-configurations.
Key Concepts
Audit Categories
| Category |
Description |
Examples |
| Hardware |
Physical components |
CPU, RAM, disks, motherboard |
| Software |
Installed applications |
Programs, versions, publishers |
| Network |
Network configuration |
Interfaces, IPs, MACs |
| Operating System |
OS details |
Version, build, architecture |
| ESXi |
VMware hypervisor info |
VMs, datastores, hosts |
| Printer |
Network printers |
Name, model, status |
Audit Freshness
Audit data is collected periodically:
- Standard devices: Every 24 hours
- Software changes: Real-time detection
- On-demand: Triggered by agent commands
Field Reference
Audit responses are grouped into hardware, operatingSystem, network, plus
the ESXi-specific blocks. The most-used fields:
| Block |
Key fields |
hardware.processor |
name, cores, logicalProcessors, speed |
hardware.memory |
totalRam, availableRam, slots[] (bytes, not MB) |
hardware.disks[] |
name, size, freeSpace, type |
operatingSystem |
name, version, architecture, installDate, lastBootTime |
network.interfaces[] |
name, macAddress, ipv4, dhcpEnabled |
| root |
lastAuditDate (epoch ms) |
See references/fields.md for the complete field reference
(hardware, software, network, and ESXi host audits).
API Patterns
| Purpose |
Endpoint |
| Full device audit |
GET /api/v2/device/{deviceUid}/audit |
| Software inventory |
GET /api/v2/device/{deviceUid}/audit/software |
| ESXi host audit |
GET /api/v2/device/{deviceUid}/audit/esxi |
| Printer audit |
GET /api/v2/device/{deviceUid}/audit/printers |
All audit endpoints take the device UID, not the device ID, and all
timestamps (lastAuditDate, lastScan, lastBootTime) are epoch
milliseconds.
See references/api.md for the full request/response
examples for each endpoint.
Workflows
Reference implementations for the common audit workflows — software compliance
check, hardware inventory report, find-devices-with-specific-software, disk
space analysis, and ESXi capacity report — are in
references/examples.md.
Error Handling
| Error |
Status |
Cause |
Resolution |
| Device not found |
404 |
Invalid deviceUid |
Verify device exists |
| Audit not available |
404 |
No audit data yet |
Wait for agent collection |
| Device offline |
- |
Agent not reporting |
Check device connectivity |
A 404 from an audit endpoint is ambiguous: it means either the device UID is
wrong or the agent has never completed an audit. Check the device exists before
concluding the audit is missing.
See references/errors.md for the audit freshness
validation helper.
Best Practices
- Check audit freshness - Verify data is recent before reporting
- Handle missing data - Not all devices have complete audits
- Use software inventory for compliance - Track required applications
- Monitor disk space trends - Use audit data for capacity planning
- Track hardware lifecycle - Use warranty and spec data
- ESXi-specific queries - Use dedicated ESXi endpoints
- Filter software results - Exclude Windows updates if needed
- Document hardware standards - Use audit to verify standards
Related Skills
1---2name: datto-rmm-audit3description: Datto RMM audit data structure covering hardware inventory (CPU, RAM, disks, motherboard, BIOS), software inventory, network interfaces, and ESXi/printer audits, along with audit collection cadence and data freshness semantics.4---56# Datto RMM Audit Data78## Overview910Audit data in Datto RMM provides detailed hardware and software inventory for managed devices. The agent periodically collects this information and reports it to the platform. This skill covers accessing audit data, understanding its structure, and common audit workflows.1112## Anti-triggers1314- **Software observed running rather than software installed** —15 RocketCyber reports application telemetry from its own sensor; use16 `rocketcyber-apps`.17- **Whether the device is reachable right now** — audit data is a18 periodic snapshot and goes stale; use `datto-rmm-devices`.19- **Inventory as documentation of record** — use20 `itglue-configurations`.2122## Key Concepts2324### Audit Categories2526| Category | Description | Examples |27|----------|-------------|----------|28| **Hardware** | Physical components | CPU, RAM, disks, motherboard |29| **Software** | Installed applications | Programs, versions, publishers |30| **Network** | Network configuration | Interfaces, IPs, MACs |31| **Operating System** | OS details | Version, build, architecture |32| **ESXi** | VMware hypervisor info | VMs, datastores, hosts |33| **Printer** | Network printers | Name, model, status |3435### Audit Freshness3637Audit data is collected periodically:38- **Standard devices:** Every 24 hours39- **Software changes:** Real-time detection40- **On-demand:** Triggered by agent commands4142## Field Reference4344Audit responses are grouped into `hardware`, `operatingSystem`, `network`, plus45the ESXi-specific blocks. The most-used fields:4647| Block | Key fields |48|-------|-----------|49| `hardware.processor` | `name`, `cores`, `logicalProcessors`, `speed` |50| `hardware.memory` | `totalRam`, `availableRam`, `slots[]` (bytes, not MB) |51| `hardware.disks[]` | `name`, `size`, `freeSpace`, `type` |52| `operatingSystem` | `name`, `version`, `architecture`, `installDate`, `lastBootTime` |53| `network.interfaces[]` | `name`, `macAddress`, `ipv4`, `dhcpEnabled` |54| root | `lastAuditDate` (epoch ms) |5556See [references/fields.md](references/fields.md) for the complete field reference57(hardware, software, network, and ESXi host audits).5859## API Patterns6061| Purpose | Endpoint |62|---------|----------|63| Full device audit | `GET /api/v2/device/{deviceUid}/audit` |64| Software inventory | `GET /api/v2/device/{deviceUid}/audit/software` |65| ESXi host audit | `GET /api/v2/device/{deviceUid}/audit/esxi` |66| Printer audit | `GET /api/v2/device/{deviceUid}/audit/printers` |6768All audit endpoints take the device **UID**, not the device ID, and all69timestamps (`lastAuditDate`, `lastScan`, `lastBootTime`) are epoch70**milliseconds**.7172See [references/api.md](references/api.md) for the full request/response73examples for each endpoint.7475## Workflows7677Reference implementations for the common audit workflows — software compliance78check, hardware inventory report, find-devices-with-specific-software, disk79space analysis, and ESXi capacity report — are in80[references/examples.md](references/examples.md).8182## Error Handling8384| Error | Status | Cause | Resolution |85|-------|--------|-------|------------|86| Device not found | 404 | Invalid deviceUid | Verify device exists |87| Audit not available | 404 | No audit data yet | Wait for agent collection |88| Device offline | - | Agent not reporting | Check device connectivity |8990A 404 from an audit endpoint is ambiguous: it means either the device UID is91wrong or the agent has never completed an audit. Check the device exists before92concluding the audit is missing.9394See [references/errors.md](references/errors.md) for the audit freshness95validation helper.9697## Best Practices98991. **Check audit freshness** - Verify data is recent before reporting1002. **Handle missing data** - Not all devices have complete audits1013. **Use software inventory for compliance** - Track required applications1024. **Monitor disk space trends** - Use audit data for capacity planning1035. **Track hardware lifecycle** - Use warranty and spec data1046. **ESXi-specific queries** - Use dedicated ESXi endpoints1057. **Filter software results** - Exclude Windows updates if needed1068. **Document hardware standards** - Use audit to verify standards107108## Related Skills109110- [Datto RMM Devices](../devices/SKILL.md) - Device management111- [Datto RMM Alerts](../alerts/SKILL.md) - Disk/hardware alerts112- [Datto RMM Variables](../variables/SKILL.md) - Store audit metadata113- [Datto RMM API Patterns](../api-patterns/SKILL.md) - Authentication and pagination
WYRE-AI