No detailed information for bulk policy deletion in tomcat logs
Article ID: 380803
Updated On:
Products
Issue/Introduction
There is no detailed information when deleting multiple policies in tomcat logs comparing to detailed information in Audit Log in Enforce GUI.
Environment
DLP Enforce 16.+
Cause
Working per design.
Resolution
DLP logs are designed to facilitate in troubleshooting issues proactively capturing data to provide some context for when an error is seen in the logs. In other words they are designed to be consumed by support and engineering and various logging code is added at the discretion of the developer as deemed necessary to facilitate these efforts. Customers can utilize these logs to look for failures that occur within the DLP code so that they can engage with support. The logs should not be considered an auditing feature given that most of the DLP logs rollover after recording a pre-configured volume of data.
The Audit Log on the other hand were designed to audit user actions within the console as such they are required to record actions initiated by a user which altered the state of data within the database. These Audit Log records are kept within the database that DLP administrators can retrieve via the console or our REST APIs.These logs are what data which requires contextual logging.
The difference is when using the control bar to execute actions across a set of policies invokes a selected policies action which doesn't have the same developer logging that the individual deletion does; however as the Audit Log is designed to record actions it did record that action.
Link https://apidocs.securitycloud.symantec.com/#/doc?id=16-1-auditlog
Feedback
