Administrative Activities report order messed up

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

The Administrative Activities report, either interactive or scheduled, has no recognizable order. Older and newer entries are all mixed up. We don't see it sorted by any column other than Date/Time either.

This is observed in a PAM cluster with multiple nodes in the primary site.

Environment

Release : 3.4.X, 4.0.0-4.0.3 and 4.1.0

Component : PRIVILEGED ACCESS MANAGEMENT

Cause

The Administrative Activities report sorted entries by entry ID rather than date/time. On cluster startup all cluster nodes have a common last entry ID. But while the cluster is running, each node adds entries with its own sequence of IDs since PAM release 3.3.0, where cluster synchronization was changed. If the last index was 10001, node one would add entries with IDs 11001, 12001 etc, node two would add entries with IDs 11002, 12002 etc. A samples listing looks as follows:

+---------+---------------------+
| entryid | createdate          |
+---------+---------------------+
| 1360001 | 2022-06-10 20:50:49 |
| 1359001 | 2022-06-10 20:50:49 |
| 1358001 | 2022-06-10 20:50:38 |
| 1357001 | 2022-06-10 20:50:38 |
| 1356002 | 2022-06-10 20:51:41 |
| 1356001 | 2022-06-10 20:50:21 |
| 1355002 | 2022-06-10 20:51:41 |
| 1355001 | 2022-06-10 20:50:21 |
| 1354002 | 2022-06-10 20:46:23 |
| 1354001 | 2022-06-10 20:49:02 |

 

Since node 2 adds fewer entries overall, it uses lower index IDs and the dates are out of order when listed by entry ID.

Resolution

As of June 2022 a fix to this problem has been checked into the source base for the next maintenance releases 4.1.1 and 4.0.4, and also for the next main release 4.2. In these future releases the report will be generated sorted by date/time. A workaround is to export the report in CSV format and sorting it by date afterwards, e.g. using Excel.