How to Determine When A Scheduled Job Was Updated In PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

There are several scheduled jobs configured in PAM, but one was recently changed and the password rotation is no longer in compliance with audit requirements. What log or report would show when the job was changed?

Resolution

Any modification to scheduled jobs will be in the Administrative Activities report. To run the report, go to Credentials > Reports > Run, then double-click on Administrative Activities. Select the desired date range, then select Scheduled Job under Type of Object and run the report.

Below is an example of how the report would look. In this case, the scheduled job DemoScheduledJob was created to run weekly, then updated to change the day of the week it ran, then was deleted.

If the Auto-Archive purge days under Settings > Credential Manager does not go far back enough to determine when the scheduled job was updated and PAM is configured to send events to Splunk or another SIEM tool through the syslog configuration, the scheduled job updates will appear as follows.