ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

How can a PAM Admin check what policies were changed


Article ID: 200716


Updated On:


CA Privileged Access Manager (PAM)


[Use case]

Policies are updated regularly.

Some users get assigned access to certain devices and some will be removed.



To track what changes were made in the policy



Release : 3.4



Syslog and session logs (Sessions > Logs) will have records of policy updates (PAM-CMN-2192 messages), creations (PAM-CMN-2193) and deletions (PAM-CMN-1484).

Note that in a cluster environment, any primary site node can perform these changes, but each node will show changes made while logged on to that node only. You will have to review the session logs of each primary site cluster node. If you have Syslog or Splunk integration, and all primary site nodes point to the same Syslog or Splunk server, you should perform your searches on the Syslog or Splunk server.

Look for following keywords.

Created policy.User: X;Host: Y
Updated policy.User: X;Host: Y
Association between user X and device Y deleted


Syslog showing creation of policy for user "CN=PAM Admin1,OU=PAM-Admins,DC=kimlabs,DC=net"

Sessions log showing Policy creation.



Syslog showing Policy Update.

Sessions log showing Policy Update


Syslog showing Policy removal.

Sessions log showing policy removal