Auditing Configuration Changes made using the eG Reporter Interface
Typically, the key configuration changes that a user can make using the eG Reporter component is to add/modify/remove favorites and schedule report configurations. To track the related changes, use the auditlog reports that eG Enterprise provides exclusively for eG Reporter.
To generate these reports, do the following:
- Login to the eG administrative interface as admin.
- Select the Reports option from the Audits tile
- Figure 6 then appears, providing a wide range of options for report generation.
- The default Timeline for the report is 24 hours. You can choose any other fixed period from the Timeline list, or select the Any option from this list. Choosing the Any timeline, allows you to provide a From and To date and time for report generation. If you change the Timeline settings, then make sure that you click the right-arrow button at its end, to register the changes.
Next, select the User whose eG Reporter-related activities you want to audit. By default, the All option is displayed here, indicating that the report provides the details of the configuration changes effected by all users to the eG Reporter. However, if only one user has actively used the eG Reporter till date, then, by default, that user’s name is displayed in the User list.
Administrators can configure the target environment for monitoring by logging into the eG administrative interface or by using the admin command line interface provided by the eG manager. This is why, by default, the audit log not only captures those configuration changes that are effected via the web-based eG administrative interface, but also logs those activities that are performed via the eG Admin Command Line Interface. While generating audit log reports, you have the option of viewing the changes across both these interfaces, or only those changes that pertain to a particular interface. To indicate your choice, use the Interface drop-down list. The options available in the Interface list are as follows:
- Web: Select this option to view those changes that were effected only via the web interface;
- Command Line: Select this option to view those changes that were effected only via the eG command line interface;
- All: Select this option to view all changes, regardless of interface.
If required, you can choose not to maintain audit logs for activities performed via the admin command line interface by setting the Include activities from the admin command line interface flag in the Auditing section of the manager settings page to No. In this case therefore, the Interface drop-down list will not appear.
The eG command line interface can currently be used only for administering the eG manager - i.e., for performing a few administrative tasks such as adding/managing components, configuring external agents/remote agents, assigning agents to secondary manager in a redundant manager setup, etc. Hence, the Interface option is currently relevant to the Admin Audit log Reports, and not the Monitor, Reporter, and Configuration Management Audit Log Reports.
- Then, indicate the column by which the auditlog report should be sorted. If the Time chosen from the Sort by list, then the resulting report will be sorted in the descending order of the event time. If any of the other options are chosen from this list box, then the report will be sorted in the ascending order of the values displayed in the chosen column.
- The Host IPs list displays all the IP addresses from which the chosen user(s) has accessed the eG Reporter interface (see Figure 9). If you are looking for information on the accesses to eG Reporter from specific IPs, select those IP addresses alone from the Host IPs list.
- Once one/more Host IPs are chosen, the Modules list will be populated with those Reporter modules that the chosen user(s) has worked with while accessing the eG Reporter interface from the selected Host IPs (see Figure 9). If you want the details of changes that the user made in specific Reporter modules only, select those modules alone from the Modules list.
- Based on the selections from the Modules list, the Activities list will be populated. While working with the eG Reporter interface, the selected user(s) might have performed a few specific operations on the chosen Modules. eG Enterprise automatically discovers the operations that correspond to the chosen user-host IP-module combination from the audit logs, and populates the Activities list with the operations so discovered (see Figure 9). If you want the details of specific activities only, select the required options alone from the Activities list.
Finally, click the Show button to generate the report.
The resulting report provides the following details (see Figure 9):
- The date/time of the change
- the name of the user who made the change
- the IP address of the host from which the user accessed the eG Reporter interface
- the module that was accessed by the user
- the specific operation/activity that was performed by the user on that module
- the Interface type that was used - whether web or command line
the detailed description of the change, followed by a snapshot of the settings prior to change, and the settings after the change; if a configuration has been newly introduced (for eg., a new schedule was created), then only the Current Settings will be displayed
By default, the every change record that the report displays will be accompanied by the Current and Previous configuration settings. This can sometimes clutter the report view, making it difficult for you to read and analyze the report. You can therefore hide both these columns from the report, by setting the ShowChanges parameter in the [audit_log_settings] section of the eg_ui.ini file to No.
You can print the report by clicking on the Print icon at the right, top corner of Figure 9, or save the report as a PDF file by clicking on the Save icon. You can even save the report as a CSV file by clicking on the csv icon in Figure 9. You can also schedule the report to be generated and mailed to the recipient at specific time intervals by clicking the icon.
In a redundant setup, all the audit log reports discussed above will have an additional manager name column, which displays the IP or host name of the manager to which a record pertains.