Using Item Trackers to audit/research who made changes in the Management Console

Products

Client Management Suite IT Management Suite Server Management Suite

Issue/Introduction

How can changes be tracked in the Symantec Management Platform 8.x

Including Samples (Samples.xml attached) and steps to create them.

Environment

8.5 and later

Resolution

Item Trackers allow admins to define the types of items they would like to capture changes to. Providing in-depth auditing for changes made through the Symantec Management Console.

Server Settings Audit

The attached file includes samples that can be enabled and cover the most commonly desired trackers for:

CEM Settings
Deployment Solution
Inventory and Metering
IT Analytics
Patch Policies
Settings
Software Management
Etc

Item Trackers can be found in the console by going to Settings> Notification Server> Internals> Item Tracking> Item Trackers.

Global Item Tracking settings

Must be enabled for any Item Trackers to function correctly
Defines where to save the data and how often to purge
Allows the ability to define what types of changes and process to track

View Tracking Records

Provides a location to see the changes that have happened and view the data

Item Trackers (Folder)

The location where Item Trackers can be created
This is where the Samples attached will be imported to
Item Trackers can have options deselected, however, if a Global Item Tracking Settings has been disabled it cannot be added

There are two ways to add Items to be tracked.

Specific items: As stated this option is used to select individual items to be tracked

Note: put attention to this type of message to make sure you only select the proper items:

Otherwise, "View tracking records" page may not showing anything.
All items within selected class: This is the more robust and preferred method for many items.
The list of possible classes can be overwhelming. The following steps can be used to determine the class to be added.
- In this example, we are going to assume that we want to track changes to Software Update policies that are deploying patches.
- To get the correct class to track go to an existing policy.
- Right click on it and select "View as XML"
- In the top section, there will be a tag like the following
  <item classGuid="{49fe4304-e09d-4382-9026-715868ffb856}" guid="{8fd5b995-ce93-441d-abca-cd5aeb137c26}">
  
  
  NOTE: The light blue section will be labeled "Namespace" in the class picker and the green will be labeled "Name"
- Use these values to easily search for the appropriate class to track

Best practices

Do not use the system drive to store Item Tracking data
In the "Tracking Filter" section of the Global and individual tracker settings, under "Modules", IIS Process (w3wp) is all that needs to be selected to capture changes made by users in a console