We are looking for an EEM audit trail.
Basically, looking for - Who created or modified any policies in EEM, when and what the changes were.
Is that possible?
Component : EEM
You will NOT be able to determine when athe user was added to the policy.
That level of detail is not recorded in the audit trail.
You can see that policyX was created or modified, and when and by who.
But you will not be able to see the details of the change, such as if a user was added to the policy or the resource was altered.
The $EIAM_HOME/logs/audit* files contain the audit records.
You can search for the policy name you are looking for and/or install and configure the EEM reporting tool.
Example of when I modified a dynamic user group policy named "userdefined-dug1"
In the example above, Eiamadmin is the id that made the change.
The type of record is soModify as apposed to an soInsert or soRemove (meaning I modified an existing policy).
The change was made on 1582820485.
That is unix epoch time for 02/27/2020 11:21:25.
If you want details on the EEM reporting utility see the product documentation at the following url: