EEM audit trail
Article ID: 185328
Updated On:
Products
Issue/Introduction
We are looking for an EEM audit trail.
Basically, looking for - Who created or modified any policies in EEM, when and what the changes were.
Is that possible?
Environment
Component : EEM
Resolution
You will NOT be able to determine when athe user was added to the policy.
That level of detail is not recorded in the audit trail.
You can see that policyX was created or modified, and when and by who.
But you will not be able to see the details of the change, such as if a user was added to the policy or the resource was altered.
The $EIAM_HOME/logs/audit* files contain the audit records.
You can search for the policy name you are looking for and/or install and configure the EEM reporting tool.
Example of when I modified a dynamic user group policy named "userdefined-dug1"
/iTechPoz/Store/WCC0004/userdefined-dug1
Policy
EiamAdmin
49f316531864b3d59f65a353b2294f0e-5e415ef3-e4240960-9
IAM.Admin.soModify.S.I
93
c9bed1762aaad8819a02cf9376b8bc39-5e415ef3-e4240960-1
host1234
iPoz
Success
1582820485
Linux 2.6.32-754.14.2.el6.x86_64
Info
In the example above, Eiamadmin is the id that made the change.
The type of record is soModify as apposed to an soInsert or soRemove (meaning I modified an existing policy).
The change was made on 1582820485.
That is unix epoch time for 02/27/2020 11:21:25.
If you want details on the EEM reporting utility see the product documentation at the following url:
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/intelligent-automation/workload-automation-ae-and-workload-control-center/11-3-6-SP8/getting-started/ca-eem-reporting-utility.html
Feedback
