EEM audit trail

book

Article ID: 185328

calendar_today

Updated On:

Products

CA Workload Automation AE - Business Agents (AutoSys) CA Workload Automation AE - System Agent (AutoSys) CA Workload Automation AE - Scheduler (AutoSys) CA Workload Automation Agent CA Workload Automation AE

Issue/Introduction

We are looking for an EEM audit trail.  
Basically, looking for - Who created or modified any policies in EEM, when and what the changes were.
Is that possible?

Environment

Component : EEM

Resolution


You will NOT be able to determine when athe user was added to the policy.
That level of detail is not recorded in the audit trail.

You can see that policyX was created or modified, and when and by who.
But you will not be able to see the details of the change, such as if a user was added to the policy or the resource was altered.

The $EIAM_HOME/logs/audit* files contain the audit records.
You can search for the policy name you are looking for and/or install and configure the EEM reporting tool.
Example of when I modified a dynamic user group policy named "userdefined-dug1"

/iTechPoz/Store/WCC0004/userdefined-dug1
Policy
EiamAdmin
49f316531864b3d59f65a353b2294f0e-5e415ef3-e4240960-9
IAM.Admin.soModify.S.I
93
c9bed1762aaad8819a02cf9376b8bc39-5e415ef3-e4240960-1
lvntest002922.bpc.broadcom.net
iPoz
Success
1582820485
Linux 2.6.32-754.14.2.el6.x86_64
Info

In the example above, Eiamadmin is the id that made the change.
The type of record is soModify as apposed to an soInsert or soRemove (meaning I modified an existing policy).
The change was made on 1582820485.
That is unix epoch time for 02/27/2020 11:21:25.

If you want details on the EEM reporting utility see the product documentation at the following url:
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/intelligent-automation/workload-automation-ae-and-workload-control-center/11-3-6-SP8/getting-started/ca-eem-reporting-utility.html