With One Identity Manager, it is possible to create a change history for objects and their properties. This can be used to fulfill reporting duties for internal committees and legal obligations for providing documentary evidence. Different methods can be used to track changes within One Identity Manager. With this combination of methods, all changes that are made in the One Identity Manager system can be traced.
-
Recording data modifications
Modifications to data can be recorded for add or delete operations on objects, and up to and including changes to individual object properties.
-
Recording process information
Recording process information allows all processes and process steps to be tracked while being processed by One Identity Manager Service.
-
Recording messages in the process history
In the process history, success, and error messages from handling each process step in the Job queues are recorded by the One Identity Manager Service.
All entries logged in One Identity Manager are initially saved in the One Identity Manager database. The proportion of historical data to total volume of a One Identity Manager database should not exceed 25 percent. Otherwise, performance problems may arise. You must ensure that log entries are regularly removed from the One Identity Manager database and archived. For more information about archiving data, see the One Identity Manager Data Archiving Administration Guide.
Detailed information about this topic
To use process monitoring in One Identity Manager.
-
In the Designer, check if the Common | ProcessState configuration parameter is set. If not, set the configuration parameter.
If the configuration parameter is set, you can configure process monitoring. In addition, the process view is enabled in the Manager.
-
You can control the extent of the logging using the configuration settings for each method.
The methods implemented by One Identity Manager allow monitoring of all modifications to the system that are triggered by a user action. Each action in One Identity Manager is labeled with a unique ID number. This ID number is called a GenProcID. All changes that can be traced back to the same cause are given the same GenProcID and are grouped in this way. If a previously stored action does not pass a GenProcID to the current action, a new ID is automatically created.
If an action is triggered from the One Identity Manager’s object layer, the GenProcID is written to the context data of the database connection. The logged in user is also noted in the context data and is made available in this way.
A new GenProcID is generated by the trigger if an action takes place directly in the database or through an application that works without the One Identity Manager object layer. This GenProcID is valid for the duration of the database connect, which means that all changes belong to the same action and link to the same GenProcID. The user data is made up of the database user’s name, the MAC address and the workstation name as well as the application name.
All actions (process triggers) that cause changes to the system, and their actual status information, are logged internally in the DialogProcess status table. Logging takes place independent of the chosen change history method. This log writing therefore provides a starting point for monitoring and allows the changes based on one action to be grouped together.
The following information is recorded for one action:
-
ID number (GenprocID)
-
Display name for the action
-
Base object that the action is triggered for
-
User that triggered the action
-
Time of action
-
Object key for selecting the process trigger
-
Comment on the action
-
Current process status
NOTE: The information is displayed in the Manager in the process view. For more information, see the One Identity Manager Operational Guide.
Detailed information about this topic
NOTE: The information is displayed in the Manager in the process view. For more information, see the One Identity Manager Operational Guide.
To log data changes
-
In the Designer, check whether the Common | ProcessState configuration parameter is set. If not, set the configuration parameter.
-
In the Designer, set the Common | ProcessState | PropertyLog configuration parameter and compile the database.
When this configuration parameter is set, changes to individual values are logged and shown in the process view in the Manager.
If you disable the configuration parameter at a later date, model components and scripts that are no longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the Conditional compilation using preprocessor conditions.
-
(Optional) To log changes for the user data part to properties that belong to an alternative key, in the Designer, set the Common | ProcessState | PropertyLog | AutoTrackAlternatePK | PayLoad configuration parameter.
-
(Optional) To log changes for the user data part to properties that belong to an alternative key, in the Designer, set the Common | ProcessState | PropertyLog | AutoTrackAlternatePK | PayLoad configuration parameter.
-
Label columns for which changes will be logged.
-
Label columns to be logged when an object is deleted.
TIP: If you set the Common | ProcessState | PropertyLog | AllDefaultPropertiesForModel configuration parameter in the Designer, One Identity Manager schema columns are already labeled for logging changes and deletions. Define which columns are affected in the QBMVDefaultHistoryColumns table.
Add, change, and delete operations can be recorded for objects. The GenProcID trigger is also passed down so that the changes to one object can be grouped together. The data changes are stored in the DialogWatchOperation and DialogWatchProperty tables. An entry is also created in the status DialogProcess table for the triggering action.
The following information is collected for these operations:
-
Adding an object
If a new object is added, the object key, object display name, date of insertion, and user are logged.
-
Changing an object
If a column is changed the old value, change date, and user are logged. Depending on the Common | ProcessState | PropertyLog | AutoTrackAlternatePK and Common | ProcessState | PropertyLog | AutoTrackAlternatePK | PayLoad configuration parameters, changes to properties belonging to an alternative key are logged.
-
Deleting an object
If an object is deleted, the columns to be logged an all primary key columns are logged. The value, deletion date and user are logged.
Related topics
TIP: If you set the Common | ProcessState | PropertyLog | AllDefaultPropertiesForModel configuration parameter in the Designer, One Identity Manager schema columns are already labeled for logging changes and deletions. Define which columns are affected in the QBMVDefaultHistoryColumns database view.
To label a column for recording
-
In the Designer, select the One Identity Manager schema category.
-
Select the table and start the Schema Editor with Show table definition.
-
Select the column and then the Column properties view.
-
Select the Miscellaneous tab and edit the following properties.
Related topics
