Report needed for Auditors

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Cloakware Password Authority (PA)

Issue/Introduction

PAM Admin needs to generate a report "View Password Requests"
However only data from the last 7 days are returned in the report.
How to retrieve the older events?

Environment

Release : 4.0.X/4.1.X and above

Component : PRIVILEGED ACCESS MANAGEMENT

Cause

Request For Information

Resolution

To prevent the database from consuming local disk space a job purges daily the metric and audit log tables.

The relevant data being purged from the database is after 7 days by default, hence the reports for the later time range is empty.

In PAM r3.x there is an indicator in Settings / Credential Manager Settings / Auto Archive when the Archive Process was run.

It is suggested to run the relevant reports in a schedule once a week and archive these reports accordingly for Auditor purposes.

Please confirm in the appliance it is taking backups of the Audit and Metrics data.

You should find them in the share which is setup to also store the session recordings in a folder

server-<HW-ID>, e.g.

server-685D66B1B3564688D962B3C63E29B6C9CF492808> ll

...

drwxr-xr-x ... auditlogs-685D66B1B3564688D962B3C63E29B6C9CF492808

drwxr-xr-x ... metrics-685D66B1B3564688D962B3C63E29B6C9CF492808

 

In there you will find in the metrics folder the older exports of the Account Requests information which you might want to reuse to build the report by own methods.