-
Title
What are the differences between a manual and scheduled Compliance Check? -
Description
In Identity Manager there are two ways to run a Compliance Check:
- The first is by manually clicking the "Recalculate All" task on the Compliance Rule
- The second is by creating a Schedule to run the Compliance Check.
Are there also any differences in using a Property Style or SQL Clause Style condition in a Compliance Check?
-
Resolution
It does not matter if a Property-style or a SQL-clause-style condition is used in a Compliance Rule.
When running a SQL select statement in a Compliance Rule and capturing the "WhereClausePerson", and comparing the "WhereClausePerson" against a Compliance Rule using a Property Style condition, the results will be the same (With the only difference being the Property Style using N' literal before the strings).
When the Compliance Rule is run using "Recalculate all", the 3 following DBQueue-tasks are queued UNCONDITIONALLY:
exec QBM_PDBQueueInsert_Single N'QBM-K-CommonRecalculate', N'CPL-K-ComplianceSubRuleFillObject', null, 'UID_ComplianceRule'
exec QBM_PDBQueueInsert_Single N'QBM-K-CommonRecalculate', N'CPL-K-ComplianceSubRuleFillPerson', null, 'UID_ComplianceRule'
exec QBM_PDBQueueInsert_Single N'QBM-K-CommonRecalculate', N'CPL-K-ComplianceCheckForRule', null, 'UID_ComplianceRule'
However, when using schedules, the following happens:
1. Schedule "Fills compliance rule objects" queues 'CPL-K-ComplianceSubRuleFillObject' and 'CPL-K-ComplianceSubRuleFillPerson'.
However, the schedules will start a compliance fill CONDITIONALLY, selecting only those ComplianceRules that fulfill conditions:
IsWorkingCopy = 0
IsInActive = 0
IsSimpleMode = 1 (only for ComplianceSubRuleFillObject)
2. Schedule "Compliance rule check" queues 'CPL-K-ComplianceCheckForRule' with conditions:
IsWorkingCopy = 0
IsInActive = 0
This means that "Recalculate all" and a Schedule queue the same tasks, albeit with some additional conditions.