SOI event policy corruption/Update

Products

• CA Service Operations Insight (SOI)

Issue/Introduction

Somehow  one of the event policy XML blocks was updated,  in what all scenarios these files can get changed or updated without any manual intervention.  

 

 

Environment

Release : 4.2

 

Resolution

The SOI Application will not modify any configuration file without manual intervention such as edit this event policy through event policy editor etc. 

 

1. Have them monitor these files through UIM application to get an alert when these files were modified

2. It might be worth checking if anti-virus or any other security application causing an issue, even they don't modify these files but when someone trying to edit they will automatically create a backup file

3. Please have them to use Auditor (SOI Console -> Tools -> Auditor) option to understand if anyone altered these event policy files