4 Replies Latest reply on May 13, 2010 10:04 AM by philh

    Where are incident lifecycle actions stored ?

    Rookie

      As per the question, does anyone know where LANDesk stores the lifecycle actions for each Incident, e.g. "Created", "Resolved", "Stop Clock" ?

       

      Specifically I'd like to be able to iterate through the stored lifecycle actions, for a given Incident, and be able to identify the date/time at which they occurred. I don't mind if this is via LANDesk directly, or via Crystal Reports, the key thing I need to know is where this data is stored in the database.

       

      I'm assuming that these lifecycle actions are stored somewhere within the database because I can view the Audit Trail for a given Incident via the LANDesk Console. If they are not stored within the database, then how does the LANDesk Console go about constructing the Audit Trail for a given Incident ?

       

      All help much appreciated, to avoid me having to tear out what is left of my hair!

       

      Phil H

        • 1. Re: Where are incident lifecycle actions stored ?
          Lara Hellman SupportEmployee

          Hi Phil,

           

          If you want to try constructing a Crystal Report from audit trail data then you need to look at the tps_audit_trail and tps_audit_trail_value tables.  Unfortunately, the data is stored inside XML strings so it's not very accessible.

           

          A better bet might be creating a report that looks at each of the Incident collections and uses the creation dates on them to reconstruct a timeline of events.  The idea being that if you have a 'Close' collection item associated to an Incident, the Close action must have been performed.

           

          Could you give us a bit more information on what it is that you want the report to display?

           

          Thanks,

           

          Lara

          • 2. Re: Where are incident lifecycle actions stored ?
            Rookie

            Lara,

             

            Thanks for that information - you're right, processing XML strings doesn't sound very appealing

             

            My specific requirement is related to a couple of earlier questions that I've posted regarding Incident clock stoppages. I need to be able to walk through the audit events, for a given Incident, and identify the "Stop Clock" and corresponding "Start Clock" events. For each pair of these events I need to be able to access the date/time at which they occurred, so that I can calculate the total amount of business time for which the clock was stopped on a given Incident.

             

            Hopefully that's the kind of information you were after, but if you need anything more then just holler and I'll try and add as much detail as I can

             

            Phil H

            • 3. Re: Where are incident lifecycle actions stored ?
              Apprentice

              Hi, Phil.

              I've got a report that does pretty much that, I think.

               

              I've linked

               

              tps_audit_trail.tps_object_guid to im_incident.pm_guid

              tps_audit_trail.creation_user to tps_user.tps_guid

              tps_audit_trail.tps_function_id to md_business_function.md_guid

               

              This gives me all Auditable actions on all Incidents - I just select from there.

               

              We're on 7.2.5 here.

               

              Dave.

              • 4. Re: Where are incident lifecycle actions stored ?
                Rookie

                Dave,

                 

                That sounds like just what I'm after! I'll have a look at those tables and see what I can get working.

                 

                Thanks,

                 

                Phil H