3 Replies Latest reply on Dec 19, 2018 1:36 PM by phoffmann

    Audit Edits/Deletion of Scheduled Tasks


      Hi all,


      We are trying to find out if there is a way to audit which user is editing or deleting scheduled tasks in LANDESK Management Suite. Often times tasks have been removed without notification to other users who would still expect it to be there.

        • 1. Re: Audit Edits/Deletion of Scheduled Tasks
          Peter Massa Expert



          You are able to configure that.  If you grant your account the "auditing configurator" role in RBA, then from the core server launch the console.  With-in the console click on Configure -> Services.  Then select the audit tab that will now appear.



          You can then choose which actions you wish to log from here.


          I will warn you though that Scheduled Task auditing is very noisy.   Our DBs would grow by an additional 50-100gb over the course of 1-2 months just from the Schedule Task auditing being enabled.  After doing research we determined 99% of this was from the Scheduler Service account updating tasks on its own and portal tasks.  It edits and starts tasks all the time.  So if you enable either of those two options, I would highly recommend adding a SQL job that runs every night to drop the service accounts scheduled task history.


          We use this sql command in our sql job to do this and keep the DB slim:

          delete from AuditInstance where Username like '%accountnamehere%' and FeatureEvent like '%Scheduled Task'


          You can then view these logs from the console under:


          Hope this helps,


          • 2. Re: Audit Edits/Deletion of Scheduled Tasks
            bdwest Apprentice

            I have configured the auditing as you describe.  That's great for moving forward.  Is there any way to determine when in the past a task was deleted, and/or who did it?

            • 3. Re: Audit Edits/Deletion of Scheduled Tasks
              phoffmann SupportEmployee

              Re: "Is it possible to see who deleted it In the past" ... if it was audited at the time - yeah,


              If it wasn't audited at the time -- then no, not really.