Administrative Activities report order messed up

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

The Administrative Activities report, either interactive or scheduled, has no recognizable order. Older and newer entries are all mixed up. We don't see it sorted by any column other than Date/Time either.

This is observed in a PAM cluster with multiple nodes in the primary site.

Environment

Release : 3.4.X, 4.0.0-4.0.3 and 4.1.0

Component : PRIVILEGED ACCESS MANAGEMENT

Cause

The Administrative Activities report sorted entries by entry ID rather than date/time. On cluster startup all cluster nodes have a common last entry ID. But while the cluster is running, each node adds entries with its own sequence of IDs since PAM release 3.3.0, where cluster synchronization was changed. If the last index was 10001, node one would add entries with IDs 11001, 12001 etc, node two would add entries with IDs 11002, 12002 etc. A samples listing looks as follows:

+---------+---------------------+
| entryid | createdate          |
+---------+---------------------+
| 1360001 | 2022-06-10 20:50:49 |
| 1359001 | 2022-06-10 20:50:49 |
| 1358001 | 2022-06-10 20:50:38 |
| 1357001 | 2022-06-10 20:50:38 |
| 1356002 | 2022-06-10 20:51:41 |
| 1356001 | 2022-06-10 20:50:21 |
| 1355002 | 2022-06-10 20:51:41 |
| 1355001 | 2022-06-10 20:50:21 |
| 1354002 | 2022-06-10 20:46:23 |
| 1354001 | 2022-06-10 20:49:02 |

 

Since node 2 adds fewer entries overall, it uses lower index IDs and the dates are out of order when listed by entry ID.

Resolution

The issue is resolved as DE537883 in the 4.0.4 and 4.1.1 releases. A workaround is to export the report in CSV format and sorting it by date afterwards, e.g. using Excel.