Auditing View Submitted Tasks (VST) Transactions - Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

This article addresses inquiries regarding the ability to export or log "View Submitted Tasks" (VST) search queries and transactions to external monitoring tools like Splunk.

Environment

Identity Manager 14.5

Cause

The VST interface is a dynamic, client-side utility that generates queries against the Task Persistence database in real-time. The specific search criteria (filters, dates, and text) entered by the user within the VST console are transient and are not recorded in the application or audit logs.

Resolution

It is important to distinguish between "VST Search Queries" and "Task Audit Data."

1. Understand Data Availability:

   • Search Criteria: The specific search queries performed by a user within the VST UI are not stored in any log file and cannot be forwarded to Splunk.
   • Task Events: The actual tasks that VST displays (the history of submitted tasks) are stored in the Task Persistence database and are subject to standard audit logging.

2. Forwarding Task Audit Data to Splunk: If the goal is to monitor the tasks themselves rather than the specific search criteria used to find them, you can capture this data via standard database auditing:

   • Database Monitoring: Configure your database (e.g., SQL Server, Oracle) to log queries or export the TaskPersistence table to a file.
   • Log Forwarding: Use a log forwarder (e.g., Splunk Universal Forwarder) to monitor the database log files or the application's audit logs.
   • Audit Policies: Ensure "Task Execution" auditing is enabled in the Identity Manager environment to maximize the audit trail data available for external ingestion.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.