Auditing in UIM Interfaces
Auditing in UIM interfaces helps you monitor the administrative activities that are performed in UIM through Operator Console or related APIs. Administrative activities include creating, updating, or deleting objects such as device groups and policies. The information is collected and stored in the database tables:
By default auditing is set to disabled. To enable/disable the auditing, do the following:
Open wasp.cfg and add the below settings under setup/auditing to enable/disable auditing
To enable: Add the key “enabled=true”
To disable: Set the key “enabled=false”
Access the Auditing Information
User information including the actions performed, datetime information and the change details are stored in these tables.
The database tables need to be queried for the auditing purposes.
Below are few sample queries:
select * from wasp_audit_log order by timestamp desc
select * from wasp_audit_details
By default, auditing is in disabled state. Auditing need to be enabled on the wasp server and can be configured using the following configuration information:
Maintain Auditing Data
When auditing is enabled, the database size increases. It is recommended that you clear the data periodically to control the database size. A purge task runs daily to clear the data beyond data retention policy of 30 days. This task is scheduled to run at 2300 hours daily (as per the UIM Server timezone) and can be configurable. General recommendation is to set Audit data purging task at the hour of the day during which there is usually less load on the database. Audit data purging is enabled by default and stores 30 days of audit data. This can be configured as per below.
Open wasp.cfg and add the below settings under setup/auditing:
- To enable audit data purging: Add the key “purge_data =true” under setup/auditing section. Supported values - true/false.
- To disable audit data purging: Add the key “purge_data =false” under setup/auditing section.
- To configure data retention policy: Add the key “days_in_history=<no_of_days_to_keep_data>” under setup/auditing section [default value is 30 days]. Supported values - any number.
- To configure when to run data purging: Add the key “purge_start_hour =<hour_when the purging should start>” under setup/auditing section [default is 2300 hours daily]. Supported values 0-23.
If auditing is disabled, then Audit data purging will not happen.
Information of Events tracked Under Auditing:
Any creation, updation or deletion of UIM configuration performed using UIM Operator console or its related APIs are recorded as per auditing.
The example UIM configurations are Inventory, Groups, Discovery Scopes etc.