Video Screencast Help

Altiris Audit Change

Created: 14 Feb 2013 | 5 comments

I have a Altiris (NS 7.1) system with roles/permissions assigned to multiple users.  I would like to track and be notified when any of these users make any changes to the Altiris system.  Any best practices for auditing an Altiris system?

I know that all Altiris objects have an audit tab on their properties.  Does anyone know what CMDB table houses the audit tab information?  I could then query that table.  Thanks for your input.

 

Comments 5 CommentsJump to latest comment

Cleuber's picture

I may have expressed myself wrong, what I need is that changes in the equipment appear CMDB Audit tab in the properties and showing who changed equipment, eg user X changed the status of the equipment to "In Stock", user Y changed location information from this same machine and so to all other fields CMDB.

Untitled.jpg
mclemson's picture

Looks like you've found the data.  Write a query against these data classes to meet your requirements.  Set up an automation policy so that it runs each morning at a set time (e.g. 1:00 a.m.) for the previous 24 hours' change (based on the Event Time column).  You will need to do this for each data class whose status history interests you.

This will not tell you what data changed -- only that someone changed the data.  Only some data classes keep a detailed history (I think that's a Status tab).

Mike Clemson, Senior Systems Engineer, ASC
Intuitive Technology Group -- Symantec Platinum Partner
intuitivetech.com

SuperSamba's picture

Do you have any examples? I am trying to track an Asset when it moves through it's Lifecycle i.e. From Stock to Active

Active to Missing

Missing to Disposed

What I would like to know is who did this, when did they did it and from which PC they did it, I can get some data from Inv_Audit however, when I try and link this to the Status it does not seem clear.

I would have though there was a standard report for this

Any help appreciated.

Thanks

djkiff9000's picture

I've made a report that shows who changed the status on a PC and when, if that will help.

SELECT
vI.Name AS 'Computer Name',
RAHD.ChangeDate AS 'Date Changed',
vF.Name AS 'Status',
vI.[ModifiedBy] AS [Changed By]

FROM ResourceAssociationHistoryDelta AS RAHD
JOIN vFixedAssetStatus AS vF
 ON ChildResourceGuid = vF._ResourceGuid
JOIN vItem AS vI
 ON RAHD.ParentResourceGuid = vI.Guid
 
WHERE vI.[Name] LIKE '%Computer%'
AND vI.[ModifiedBy] != 'Domain\Service Account' (replace with your Service account name)
ORDER BY vI.Name, RAHD.ChangeDate, RAHD.CreatedDate DESC

Just create a parameter for %Computer% so you can put in the PC name or a wildcard.