This article covers finding evidence that the appropriate level of application audit logging has been configured for the CDA/ARA application for the following events:
- Access to audit trails
- Initialization, stopping, and pausing of the audit logs
N/A
Release : 12.3
Component :
In CDA the so called "History records" are automatically written into the database whenever a CDA-object was modified/created and can be seen in the UI (= when, who, old field-value, new field-value) . There is no way to stop these type of logging.
https://docs.automic.com/documentation/webhelp/english/ARA/12.3/DOCU/12.3/CDA%20Guides/Default.htm#_Common/CommonFunctions/CF_ARA_StatHistory.htm?Highlight=History%20records
There is also a feature of Revision Report.
https://docs.automic.com/documentation/webhelp/english/AA/12.3/DOCU/12.3/Automic%20Automation%20Guides/help.htm#Utilities/admin_AboutAEDBRevisionReport.htm#link1
Wiith the Automation Engine, audit logging can be enabled, as per our documentation: https://docs.automic.com/documentation/webhelp/english/ARA/12.3/DOCU/12.3/CDA%20Guides/Default.htm#_Common/Security/Security_AudReps.htm?Highlight=audit
This documentation link also covers what gets legged by the Automation Engine.
We can also confirm that turning on / off this audit log is captured in the logs (WPServer) as well in following format
Audit on:
20210901/113234.534 - U00011872 Client table modified.
20210901/113234.534 - U00011869 Client/Mode/TaskPrio/AH_Idnr/TZ/Prio/EH_Kick/Cale_Ahead/VersionMgmnt/XRO/Object_Audit: 0001/GO /200/0001994002/ /200/0003/0014/Y/N/Y
Audi off:
20210901/113820.627 - U00011872 Client table modified.
20210901/113820.627 - U00011869 Client/Mode/TaskPrio/AH_Idnr/TZ/Prio/EH_Kick/Cale_Ahead/VersionMgmnt/XRO/Object_Audit: 0001/GO /200/0001994002/ /200/0003/0014/Y/N/N