Is there a way to find out which user performed what operation in Autosys (when Autosys is configured with EEM) ?

Products

• Autosys Workload Automation

Issue/Introduction

This article provides a very high level overview.  There may be other simpler options too (autotrack for example to look into any job related operations being performed)

Resolution

1) Create a custom EEM Event Policy for WorkloadAutomationAE application in EEM

2) Manage Access Policies -> Event Policies ->  Create a new policy that  audits everything (SUCCESS and FAILURE)

Resource:   auth*               
Identities:  All Identities   
Actions: All Actions
Filters:    none

3) Save the policy

4) check <EEM>\logs\audit.log   

5) perform an operation in autosys, say autorep / sendevent,   the operation now should get logged into the audit.log.

<Event>
<Taxonomy>IAM.Runtime.authorizeWithSession.S.I</Taxonomy>
<Src>WorkloadAutomationAE</Src>
<Identity>ejmcommander</Identity>
<Method>authorizeWithSession</Method>
<Resource>execute/as-job/R12.test_box</Resource>
<Error>0</Error>
<ErrorCode>EE_SUCCESS</ErrorCode>
<PolicyName>R12: Default Job Policy</PolicyName>
<GUID>XXXXXXXXXXXXXXXXXXXXX</GUID>
<SequenceNumber>42</SequenceNumber>
<TimeZone>0</TimeZone>
<Location>hostname.example.com</Location>
<RecorderHost>hostname.example.com</RecorderHost>
<Recorder>WorkloadAutomationAE</Recorder>
<Version>1.0</Version>
<Log>EiamSdk</Log>
<EventLog>EiamSdk</EventLog>
<Hostname>rrudr-rh8-121-1</Hostname>
<iSponsorName>EiamSdk</iSponsorName>
<Status>Success</Status>
<Date>1708962035</Date>
<OS>Linux 4.18.0-477.27.1.el8_8.x86_64</OS>
<Severity>Info</Severity>
</Event>

 

To be able to read the audit log better, EEM Reporting Utility (ERU) can be setup and you can use ERU Client to generate an Authorization report,  example: 

java -jar /opt/CA/WorkloadAutomationAE/ERU/EEMClient/EEMReporting.jar -n NewReport -d reports -e pdf -t authorization -c method datetime status source resource identity policy -f status=success -o datetime ASC

 

A sample screen shot of a  start job on a box job:  test_box  is below:

Additional Information

To install and configure ERU - 

https://techdocs.broadcom.com/us/en/ca-enterprise-software/intelligent-automation/autosys-workload-automation/12-1-01/getting-started/ca-eem-reporting-utility/install-the-ca-eem-reporting-utility.html

 

What audit events are supported:

https://techdocs.broadcom.com/us/en/ca-enterprise-software/intelligent-automation/autosys-workload-automation/12-1-01/getting-started/ca-eem-reporting-utility/audit-events.html

 

How to generate reports: 

https://techdocs.broadcom.com/us/en/ca-enterprise-software/intelligent-automation/autosys-workload-automation/12-1-01/getting-started/ca-eem-reporting-utility/generate-reports.html