Enabling and storing audit trails

You can maintain audit trails for information stored in the database and in the plan. By default, auditing is enabled. To disable auditing, use the following global options:

enDbAudit: Enables auditing of the information available in the database.
enPlanAudit: Enables auditing of the information available in the plan.

For more information about global options, see Global options - detailed description.

You can store auditing information in a file, in the HCL Workload Automation database, or in both. To define in which type of store to log the audit records, use the auditStore global option. For more information about global options, see Global options - detailed description. When auditing database information, all the user modifications are logged, including the current definition of each modified database object. If an object is opened and saved, the action is logged even if no modification was made. When auditing plan information, all the user modifications to the plan are logged. Actions are logged whether or not they are successful.

Choose the storage location of audit records according to the type of information you are auditing, whether it is database or plan:

auditing of the information available in the database (enDbAudit global option): You can track changes to the database in a file, in the database itself, or in both. To define which type of store to log the audit records, use the auditStore global option. For more information about global options, see Global options - detailed description. All the user modifications are logged, including the current definition of each modified database object. If an object is opened and saved, the action is logged even if no modification was made.
auditing of the information available in the plan (enPlanAudit global option): You can track changes to the plan in a file. When you enable auditing of the information available in the plan, the information is saved to a file. All the user modifications to the plan are logged. Actions are logged whether or not they are successful.

Storing auditing information in a file (auditStore=file)

This storage location is available when you audit information in the database (enDbAudit global option) and in the plan (enPlanAudit global option). Choose to store auditing information in a file by setting the auditStore global option to file. For more information about the auditStore global option, see Global options - detailed description.

Each audit log provides audit information for one day, from 00:00:00 UTC to 23:59:59 UTC regardless of the time zone of the local workstation, but the log file is created only when an action is performed or the WebSphere Application Server Liberty is started.

The files are called yyyymmdd, and are created in the following directories:

<TWA_home>/TWS/audit/plan <TWA_home>/TWS/audit/database

Audit entries are logged to a flat text file in .json format on the master domain manager and backup master domain manager.

The log formats are the same for both plan and database. The logs consist of a header portion which is the same for all records, an action ID, and a section of data that varies according to the action type. All data is kept in clear text and formatted to be readable and editable from a text editor such as vi or notepad.

For more information about the details available in the logs, see Audit log header format and Audit log body format.

Note: For modify commands, two entries are made in the log for resources, calendars, parameters, and prompts. The modify command is displayed in the log as a combination of the delete and add commands.

See the following example of a .json file:

{"timestamp": "20210917062859", "auditType": "CONMAN", "objectType": "PLWKSTN", 
"actionType": "MODIFY", "workstationName": "WA_DWB", "userName": "wauser", "frameworkUser": 
"", "objectName": "WA_DWB", "actionDependentContents": "link @;noask"}

Storing auditing information in the database (auditStore=db)

This storage location is available when you audit information in the database (enDbAudit global option). Choose to store auditing information in the database by setting the auditStore global option to db. For more information about the auditStore global option, see Global options - detailed description.

The AUDIT_STORE_RECORDS_V table is created in the HCL Workload Automation database.

For more information, see AUDIT_STORE_RECORDS_V.

Storing auditing information both in the database and in a file (auditStore=both)

This storage location is available when you audit information in the database (enDbAudit global option). Choose to store auditing information both in the database and in a file by setting the auditStore global option to both. For more information about the auditStore global option, see Global options - detailed description.

For details about how the information is stored, see Storing auditing information in the database (auditStore=db) and Storing auditing information in a file (auditStore=file).