Using Item Trackers to audit/research who made changes in the Management Console

Products

• Client Management Suite
• IT Management Suite
• Server Management Suite

Issue/Introduction

How can changes be tracked in the Symantec Management Platform 8.5 and 8.6

Including Samples (Samples.xml attached) and steps to create them.

Environment

8.5 and later

Resolution

Item Trackers allow admins to define the types of items they would like to capture changes to.  Providing in-depth auditing for changes made through the Symantec Management Console.

The attached file includes samples that can be enabled and cover the most commonly desired trackers for:

• CEM Settings
• Deployment Solution
• Inventory and Metering
• IT Analytics
• Patch Policies
• Settings
• Software Management
• Etc

Item Trackers can be found in the console by going to Settings> Notification Server> Internals> Item Tracking> Item Trackers.

Global Item Tracking settings 

• Must be enabled for any Item Trackers to function correctly
• Defines where to save the data and how often to purge
• Allows the ability to define what types of changes and process to track

View Tracking Records

• Provides a location to see the changes that have happened and view the data

Item Trackers (Folder)

• The location where Item Trackers can be created
• This is where the Samples attached will be imported to
• Item Trackers can have options deselected, however, if a Global Item Tracking Settings has been disabled it cannot be added

There are two ways to add Items to be tracked.

• Specific items: As stated this option is used to select individual items to be tracked
• All items within selected class: This is the more robust and preferred method for many items.
  The list of possible classes can be overwhelming.  The following steps can be used to determine the class to be added.
  • In this example, we are going to assume that we want to track changes to Software Update policies that are deploying patches.
  • To get the correct class to track go to an existing policy.  
  • Right click on it and select "View as XML"
  • In the top section, there will be a tag like the following 
    <item classGuid="{49fe4304-e09d-4382-9026-715868ffb856}" guid="{8fd5b995-ce93-441d-abca-cd5aeb137c26}">
    <!-- Type: Altiris.PatchManagementCore.Policies.SoftwareUpdateAdvertismentSetPolicy -->
    <!-- Assembly: Altiris.PatchManagementCore, Version=8.5.3049.0, Culture=neutral, PublicKeyToken=d516cb311cfb6e4f -->
    NOTE: The light blue section will be labeled "Namespace" in the class picker and the green will be labeled "Name"
  • Use these values to easily search for the appropriate class to track

Best practices

• Do not use the system drive to store Item Tracking data
• In the "Tracking Filter" section of the Global and individual tracker settings, under "Modules", IIS Process (w3wp) is all that needs to be selected to capture changes made by users in a console

 

Additional Information

KB 241682 "SMP server is maxing out the memory usage for aexsvc and w3wp services"

KB 173227 "Is there a way to track the activities of IT Management Suite administrators?"

Use ITMS TechDoc to create and configure Item Trackers in the SMP Console:

--Configuring Global Settings for Item Tracking

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/it-management-suite/ITMS/Administration/common-ui-controls-context-topics-v15670514-d846e9349/configuring-global-settings-for-item-tracking-v127107832-d846e46995.html#v127107832

--Creating an Item Tracker

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/it-management-suite/ITMS/Administration/common-ui-controls-context-topics-v15670514-d846e9349/creating-an-item-tracker-v127107835-d846e47106.html

--Viewing Item Tracking Data

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/it-management-suite/ITMS/Administration/common-ui-controls-context-topics-v15670514-d846e9349/viewing-item-tracking-data-v127107838-d846e47214.html