How to export Orchestrator alert logs to a CSV file for a specific time period (e.g., for an audit)?
Description:
Orchestrator does not have a built-in UI export option for alert logs. However, all alert data is accessible via the /odata/Alerts API endpoint, which supports date range filtering and pagination.
The PowerShell script below handles authentication, paginates through all matching records, and exports the results to a CSV file. All parameters are prompted interactively at runtime.
Steps to follow:
1. Save the script below as Export-OrchestratorAlerts.ps1
param(
[string]$StartDate,
[string]$EndDate,
[string]$BaseUrl,
[string]$Username,
[string]$TenancyName,
[string]$OutputFile
)
if (-not $BaseUrl) { $BaseUrl = Read-Host "Orchestrator URL (e.g. https://orchestrator.local)" }
if (-not $Username) { $Username = Read-Host "Username" }
if (-not $TenancyName) { $TenancyName = Read-Host "Tenancy name (press Enter for 'Default')" }
if (-not $TenancyName) { $TenancyName = "Default" }
$Password = Read-Host "Password" -AsSecureString
$PlainPassword = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
[Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password))
if (-not $StartDate) { $StartDate = Read-Host "Start date (YYYY-MM-DD)"; if (-not $StartDate) { $StartDate = "2025-06-15" } }
if (-not $EndDate) { $EndDate = Read-Host "End date (YYYY-MM-DD)"; if (-not $EndDate) { $EndDate = "2026-06-15" } }
if (-not $OutputFile){ $OutputFile = Read-Host "Output CSV path (e.g. C:\temp\alerts_export.csv)"; if (-not $OutputFile) { $OutputFile = "C:\temp\alerts_export.csv" } }
try {
$startUtc = ([datetime]::Parse($StartDate)).ToString("yyyy-MM-ddT00:00:00Z")
$endUtc = ([datetime]::Parse($EndDate)).ToString("yyyy-MM-ddT23:59:59Z")
} catch {
Write-Error "Invalid date format. Use YYYY-MM-DD (e.g. 2025-06-15)"; exit 1
}
Write-Host "`nExporting alerts from $startUtc to $endUtc ..." -ForegroundColor Cyan
# Authenticate
$authBody = @{
tenancyName = $TenancyName
usernameOrEmailAddress = $Username
password = $PlainPassword
} | ConvertTo-Json
$token = (Invoke-RestMethod -Uri "$BaseUrl/api/account/authenticate" `
-Method POST -ContentType "application/json" -Body $authBody).result
$headers = @{ Authorization = "Bearer $token"; "X-UIPATH-OrganizationUnitId" = "1" }
$dateFilter = "CreationTime ge $startUtc and CreationTime le $endUtc"
$allAlerts = @()
$top = 1000; $skip = 0
do {
$url = "$BaseUrl/odata/Alerts?`$filter=($dateFilter)&`$top=$top&`$skip=$skip&`$orderby=CreationTime asc"
$response = Invoke-RestMethod -Uri $url -Headers $headers -Method GET
$allAlerts += $response.value
$skip += $top
Write-Host " Fetched $($allAlerts.Count) / $($response.'@odata.count') records..."
} while ($allAlerts.Count -lt $response.'@odata.count')
$allAlerts | Select-Object CreationTime, Severity, Component, NotificationName, State,
@{Name="Message"; Expression={ ($_.Data | ConvertFrom-Json).Message }} |
Export-Csv -Path $OutputFile -NoTypeInformation -Encoding UTF8
Write-Host "`nDone. $($allAlerts.Count) records exported to: $OutputFile" -ForegroundColor Green
2. Run the script
Interactive (prompts for all inputs):
.\Export-OrchestratorAlerts.ps1
Or pass parameters directly (useful for scheduled/automated runs):
.\Export-OrchestratorAlerts.ps1 `
-BaseUrl "https://orchestrator.local" `
-Username "admin" `
-TenancyName "Default" `
-StartDate "2025-06-15" `
-EndDate "2026-06-15" `
-OutputFile "C:\temp\alerts_export.csv"
3. Locate the output file
The exported CSV will contain the following columns: CreationTime, Severity, Component, NotificationName, State, Message.