1 Reply Latest reply on Nov 16, 2016 10:30 PM by Peter Massa

    Audit Edits/Deletion of Scheduled Tasks

    Apprentice

      Hi all,

       

      We are trying to find out if there is a way to audit which user is editing or deleting scheduled tasks in LANDESK Management Suite. Often times tasks have been removed without notification to other users who would still expect it to be there.

        • 1. Re: Audit Edits/Deletion of Scheduled Tasks
          Peter Massa Expert

          avasile,

           

          You are able to configure that.  If you grant your account the "auditing configurator" role in RBA, then from the core server launch the console.  With-in the console click on Configure -> Services.  Then select the audit tab that will now appear.

           

           

          You can then choose which actions you wish to log from here.

           

          I will warn you though that Scheduled Task auditing is very noisy.   Our DBs would grow by an additional 50-100gb over the course of 1-2 months just from the Schedule Task auditing being enabled.  After doing research we determined 99% of this was from the Scheduler Service account updating tasks on its own and portal tasks.  It edits and starts tasks all the time.  So if you enable either of those two options, I would highly recommend adding a SQL job that runs every night to drop the service accounts scheduled task history.

           

          We use this sql command in our sql job to do this and keep the DB slim:

          delete from AuditInstance where Username like '%accountnamehere%' and FeatureEvent like '%Scheduled Task'

           

          You can then view these logs from the console under:

           

          Hope this helps,

          Peter