Question

audit trail - change entry permission

Audit Trail Version 9 Security

Updated November 20, 2013

asked on November 11, 2013

I am generating an audit trail report on Laserfiche RIO for entries which had their access rights changed.

1. However, I am not getting all details. The most important details are left out blank in the report. Please see sample below (hostnames removed)


Event Time	Event Type	Succeeded?	Host Name	Application Name	Login Name	Inherits Rights?	Old Security Descriptor	New Security Descriptor	Entry ID	Full Path	Entry Name
11/11/2013 10:59:22	Change Entry Permissions	True	********	Client (9.0.1.610) (LFSO/9.0.1.605)	Admin2
08/11/2013 15:24:03	Change Entry Permissions	True	********	Client (9.0.2.728) (LFSO/9.0.2.660)	Admin2

2. When configuring AT, I've chosen the default option Repository (The Laserfiche Server manages all of my audit logs. Audit Trail will retrieve real-time audit data from the Laserfiche Server.) I'm noticing that the data in the report is not in real time.

3. From what I understand the database stores the data for reporting services only and the retention period set in the LF AT configuration is for the database only. The audit logs are not deleted automatically based on this setting but need backup. However, I can't locate my audit logs based on the setting in pt 2 above.

To note that I'm using a 3-tier architecture with LF app on 1 server, the MS SQL database on a 2nd server and LF AT on the 3rd server (web server).

Thanks

0 0

Answers

APPROVED ANSWER

replied on November 11, 2013 • Show version history

Hi Neermal,

1. Please refer to Justin Pava's response below.

2. By real time do you mean that the dates that are showing up in the audit report are incorrect, or that the audit trail doesn't update when you make a change and then click on "update" and the change is not there until after a while.

If the datetime that is displayed on each change is not correct to you, then the issue lies in the timing being off between the laserfiche server and client workstation which is rare cause it should give you other types of time syncronization errors.

If you are reffering to latter, then that is because either it takes longer to update the Audit Trail database or that it takes longer time for Audit Trail service to get the new changes.

3. The actual audit logs are stored by default in your repository folder in the server with folder name "Audit". But yours can be different. To find the exact path, log in to your repository in Admin Console and under Auditing go to Rollover Logs and you will see the path of your logs.

Hope this helps.

5 0

SELECTED ANSWER

replied on November 11, 2013

Hi,

Thanks for your responses.

Justin - I'm on RIO 9.0.2 which is is being used live but can't find the hotfix to 9.0.3. Please advise how to upgrade.

Mohammad - For question 2, Audit trail - the scenario is the latter. When I make a change on the server, say access rights, and query the Audit trail report, the changes are not reflected until much later. This is a concern for me since there is not much activity yet. There are only some 15 users out of 160 as at now.

For question 3, it is OK.

Regards

0 0

replied on November 12, 2013

Hi Neermal,

I have a standalone test system with Laserfiche Server and Audit Trail installed on the same machine. It takes about 5 seconds to get the latest update in Audit Trail. Other factors such as the server specs and network traffic can cause delay. Do you have an estimate on how long it takes to update?

Hope this helps.

1 0

replied on November 12, 2013

Laserfiche 9.0.3. is a full maitnaince release for 9.0, so there isn't a strandalone hotfix or patch file. You can download the package from the support site and install it on top of your existing 9.0.2 audit trail reporter installation. General information about the release is avaliable here.

0 0

Replies

replied on November 11, 2013

I believe item 1 was a bug in the audit trail reporter that was fixed in version 9.0.3. Your data is fine in this case, the reporter just wasn't getting it in the reports.

2 0

replied on November 20, 2013

For item 2, the way importing works is this: Normally, Audit Trail will log into your repository every 5 minutes to query for new events and import them into the reporting database. When someone is actively running a report through the web reporting interface, that repository will get moved to a priority timer, and query for new events every 60 seconds. This means on average it should take 30 seconds for an event to make its way from the server to the reporting database. Is the delay you are seeing in line with that, or are you finding that it takes longer?

0 0

You are not allowed to follow up in this post.

Question

Question

audit trail - change entry permission

Answers

Replies

Sign in to reply to this post.