Audit trails

[oz1]

We are concidering turning on a number of MIMS Audit trails to track changes to Purchase Orders, Supplier files and HR files among others.

However there is a concern about the negative inpact the running of these Audit trails may have on the Production system.

Has anyone else tried running a number of diffrent Audit trails at once and what has the effect on performance been?

Are there any other issues we should be aware of?

 

[Glen]

I have run it to track changes to the MSF000(s), MSF020 and the MSF260 tables. I did not notice any measurable impact on on-line performance (there were performance monitoring tools in place).

Turning on the auditing process did create some problems when compiling programs - particularly when compiling for trace. There were several programs that we needed to write a custom mscobol script to handle.

I'm assuming that you are aware that you will need to write the programs to extract the audit information. This can be a rather complicated programming effort depending on how much you audit.
Glen Colbert
gcolbert@RAG_American.com

 

[CindyMCC]

We use the audit facility pretty extensively for the system control file, tables, security and establishment; purchase order pricing changes, equipment register, and others. We have made a minor change to the mscobol script to ensure you always use the audit definition file with compiles and with that we have not had any problems at all either with compiling and tracing or system performance.

The records end up in the msf034 table and depending on the number of transactions your process through MIMS they can grow very quickly. We have this managed with autoscheduled reports for the trails we need - and we regularly run the purge program to keep the table size reasonable.

There is a facility that auto-generates a canned audit report that will give you before and after snapshots of all fields. These RDLs will always need some customization and you may of course want to only look for certain situations that you are trying to monitor.

We would be happy to present this as a topic at the 2001 System Admin and/or Systems Technical workshops and we could compare notes.

 

[MikeLeung]

It depends on what version of MOE that you are using (assume that you are using Mincom-TP). The later version of MOE (MIMS Operating Environment) comes with mscomp script and it looks up compile.tbl and look for ADF directive. If you specify an ADF directive in compile.tbl, mscomp will compile the programs that you define in the adf file with audit features. There is no need to modify mscobol script. In addition, there is a script msgenaud to generate audit RDLs for the file that you want to audit.

One of the Mincom customer use audit features very extensively and there is no problem with it except that you need to maintain MSF034 tables like CindyMCC mentioned. You need to make sure to setup MSB033 and MSB034 as cyclic request.

I have some doco on Audit feature and let me know if you want it.

Mike

 

[oz1]

Mike,
I would love to get my hands on the doco you are refering to my e-mail address is tonydowns@today.com.au

Thanks

 

[MikeLeung]

Tony,

I sent you the doco and hope it helps.

Mike

 

[oz1]

In regard to above MIKE and CINDY say that they know of sites which run extensive audit trails.
I have had advise from Mincom that it would be unwise to audit the District and System control files. Does anyone know anyone who does? Have they had any problems with the size of the data, which is captured.

Also I would like to know about the conditions which can be set up in the ADF file. I believe it is possible to activate an audit trail to capture changes by a nominated user but is it possible to go the other way and set it up so that it would not log activities by certain users.

Finally, is it possible to set up an audit trail so it would only record modification and deletions of data but not the creation. For example, if you activated the audit trail to cover purchase orders and the order was a 'clean' (received and paid with no modification) then this data could be seen via MSO221 and there would no need for it to be trapped by an audit trail. On the other hand if there had been changes you might.

 

[Calator]

OZ1,
we have had experience with auditing Security, HR/Payroll and Purchasing(Contract Admin and FPAs) in MIMS 4.1. Here are some notes:
1. some areas in MIMS have intrinsic auditing on the normal tables, ie PO history of changes msf222, Contract History msf394-397, etc so possibly you do not need to implement Audit Trail unless you have specific requirements
2. Audit Conditions: can be specified as Cobol conditions on the audit plan file line, eg we use following entry to audit FPA Group and Agreement only (to exclude FPA Items from auditing):
MSO254 MSF254 IF (MSF254-FPA-ITEM-NO=ZEROS) AND (MSF254-FPA-REC-TYPE="F&quot
You ask about limiting auditing to particular userid and actions, I would suggest to use the request parameters of audit reports and not the audit plan file for that purpose, ie audit all users & actions but filter at reporting time. Note that if audit records have not been collected by MIMS because you restricted to a particular user, if the need arises in the future to track on somebody else's past actions it will be impossible to report.
3. Audit reports:All our audit reports are custom RDL's usually based on the auto-generated MSZ* reports. In the past we had instances when some MSZ* programs would not compile or would generate wrong output especially with OCCURS fields.
MSZ* are very technical and we had to create user-friendly output.
4. Records Volumes: you may need to monitor together with your database administrator. We have no reports so far on adverse impact on performance. We would run MSB033 periodically but once you ran MSB034 all your audit records are gone, so make sure hard-copy reports have been archived or better still a copy/extract of MSF034 is available. Until recently (Oct/00) redundant start/end transactions records were being written by MIMS 4.1 so if you run this version ask Mincom for the latest patch to macros
5. We had some issues with MSB033 in multi-district environments; test carefully what happens with msf033a/b as you run MSB033 with or without the district code field spaced out on MSM080B
6. Be aware audit records are available for reporting only after MSB033 ran, and then possibly with a 2 days delay if MSB033 runs daily and switches operation from msf033a to msf033b
7. after re-compile of program with the /audit option be aware audit records colection may not start straight away, you need to ensure the new executables are used and one way of doing that is to shutdown and re-start Mims.

 

[ridz]

Everyone,
I'm the System Administrator and the new user of MIMS Ver. 4.3.1.2. It's good if you could guide me on how can I set the Audit cyclic report. Also, I need further guidance on all its features. The Management has been asking me how can they trace all POs, PRs, etc that have been generated.