Audit log of configuration: History of Export/Import?

[Former Member]

Hello Experts,

Due to audit requirements, our client requested that a log of all changes to the productive system be logged.

We have accomplished this by maintaining a manual log of changes, but this is not a satisfying solution for an audit.

We are currently doing all transports by using the MMC Import/Export function, so we do not have any record of the change beside the produced mmc file.

Is there any table were the history of such transport is stored? We would just need to have the date/time of the import and the name of the imported file.

We have though of several other options, but each have their own weakness:

• Using the Task/Job last changed date, we can only have the time of the last change. If the report is done monthly, we could miss a lot of changes. It is also quite difficult to separate the tasks as all task in a hierarchy as marked as changed when importing.
• Using the Version Control mechanism of IDM, we can have the history of changes. We have not checked if we can import a job that is cheked in, if not we should be able to use this. But we are concerned that this may cause issues during transport if a workflow is partially checked in, and this can only track changes on jobs, not tasks
• Using only full configuration transport. We can have the full history of when a transport was done, but no details on what exactly changed between version. It would also require a huge change of our current transport workflow to avoid transporting unwanted changes to production and making sure each time that transport is correct.

So, did any of you meet this requirement? If so, how did you fulfill it? What information can we use to produce a complete and accurate report of the changes and transport to the productive system, if possible without increasing risk of errors during the transport ?

Thanks,

Julien Garagnon

[former_member2987 · Accepted solution]

Hi Julien,

No there's really no record of import / export, although this sounds like something that should be added to the idea place for Version 8.

The only think I can think of would be a job to trigger the launching of Import/Export but of course it could still be called manually.

Matt

[Former Member · Accepted solution]

Hi Matt, Julien,

in IDM 8.0 Eclipse IDM Development studio you have full revision history of the configuration packages.

Is this what you mean?

Best wishes,

Fedya

[Former Member · Accepted solution]

Hello Fedya,

This is exactly the kind of information we would need, but we are currently using IDM 7.2.

There is also a check-in/check-out process in this version, but it only work at the job level, and I do not know how it works with transports.

I think the solution we will offer the client is to keep the history of exported files and generate a regular report of the last modification date of the tasks/jobs.

I will keep this topic open for a few days to see if any solution arises, but otherwise it seems we are out of luck.

Regards,

Julien

[former_member187331 · Accepted solution]

Hello Julien,

in IdM 7.2 we are using a different approach.
Every developer has his own "mxmc_admin"-user and we log the changes with database-traces on several tables which contain tasks/jobs.
This way you can fullfill your audit requirements, because logging is done on database-level and is fully isolated by the user doing changes in the system.

1. Step: Create a seperate mxmc_admin_<username> database-user for every developer with same permissions like the "original" mxmc_admin.

2. Step: Enable Database-Traces on Tables like mc_jobs or mc_tasks (hope i spelled them right).

3. Step: Most of the essential changes on the idm configuration is logged in the database-traces with timestamp, change and the user who did it. This way you a pretty reliable solution.

Greetings, Aydin

[Former Member · Accepted solution]

This seems a perfect answer to get a complete audit of the configuration changes.

Our current client is satisfied with a simpler solution having only the last modifications date of the jobs and an history of transported files, but I will keep this one on file for future reference.