Windchill Auditing

[pwilliams-3]

We are thinking of turning on event based auditing on our Windchill 9.1 M050 system. I was wondering if anyone had done this and could answer the following questions:


1. What were the business reasons for turning on the auditing (SOX compliance, IP protection, security tracking)?


2. What specific events are currently being audited (service and summary)?



3. Was there a performance hit when auditing was turned on? If so, what was done to improve the performance?



4. How often to you purge the audit logs? Do you convert the purged records to XML and checkin to Windchill as WTDocs?



Thanks in advance.

Patrick Williams | Engineering Systems | o: 616.698.3766 | c: 616.947.2110
[cid:image001.jpg@01CC5B53.A1762730]

[MikeLockwood]

See attached - I started this and never really finished. Not much documented OTB.

Be careful about enabling workflow-related settings - I brought our production system to its knees a while back doing this. Tech support said "oh, of course - use these only for testing on a development system" (but this is not documented any where).

[pwilliams-3]

Mike,
I found a way to just record the deletion of EPMDocuments. See below.


<keyedevententry eventkey="*/wt.events.summary.ChangeIdentitySummaryEvent/" enabled="false" handler="wt.audit.configaudit.ChangeIdentityEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ChangeLifecycleStateSummaryEvent/" enabled="false" handler="wt.audit.configaudit.ChangeLifecycleStateEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.CheckinSummaryEvent/" enabled="false" handler="wt.audit.configaudit.CheckinEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.CheckoutSummaryEvent/" enabled="false" handler="wt.audit.configaudit.CheckoutEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.CompleteSummaryEvent/" enabled="false" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.CopySummaryEvent/" enabled="false" handler="wt.audit.configaudit.CopyEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.CreateSummaryEvent/" enabled="false" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.DeleteSummaryEvent/" enabled="false" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ExportSummaryEvent/" enabled="false" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ImportSummaryEvent/" enabled="false" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.MarkupAnnotateSummaryEvent/" enabled="false" handler="wt.audit.configaudit.MarkupAnnotateEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ModifyAccessPolicySummaryEvent/" enabled="true" handler="wt.audit.configaudit.ModifyAccessPolicyEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ModifyContentSummaryEvent/" enabled="false" handler="wt.audit.configaudit.ModifyContentEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ModifyObjectAccessSummaryEvent/" enabled="false" handler="wt.audit.configaudit.ModifyObjectAccessEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ModifyProductStructureSummaryEvent/" enabled="false" handler="wt.audit.configaudit.ModifyProdStructureEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ModifySecurityLabelsSummaryEvent/" enabled="false" handler="wt.audit.configaudit.ModifySecurityLabelsEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ModifySummaryEvent/" enabled="false" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ModifyTeamSummaryEvent/" enabled="true" handler="wt.audit.configaudit.ModifyTeamEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.MoveSummaryEvent/" enabled="false" handler="wt.audit.configaudit.MoveEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.NewViewVersionSummaryEvent/" enabled="true" handler="wt.audit.configaudit.VersionEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.OneOffVersionSummaryEvent/" enabled="true" handler="wt.audit.configaudit.VersionEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ReviseNewVersionSummaryEvent/" enabled="false" handler="wt.audit.configaudit.VersionEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ShareSummaryEvent/" enabled="false" handler="wt.audit.configaudit.ShareEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.UndoCheckoutSummaryEvent/" enabled="false" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
</configentry>


<configentry class="wt.epm.EPMDocument" enabled="true">
<keyedevententry eventkey="*/wt.events.summary.CheckoutSummaryEvent/" enabled="true" handler="wt.audit.configaudit.CheckoutEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.CopySummaryEvent/" enabled="true" handler="wt.audit.configaudit.CopyEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.CreateSummaryEvent/" enabled="true" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.DeleteSummaryEvent/" enabled="true" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
<keyedevententry eventkey="*/wt.events.summary.ExportSummaryEvent/" enabled="true" handler="wt.audit.configaudit.DefaultAuditEventRecorder"/">
</configentry>

Patrick Williams | Engineering Systems | o: 616.698.3766 | c: 616.947.2110
[cid:image003.jpg@01CC5C2D.28080640]

From: Lockwood,Mike,IRVINE,R&D [