5 of 5 people found this helpful
You can still get the info you are looking for on the Control-M/Server from running ctmlog utility. See the Control-M Utilities Guide for the full details of all the parameters to get the report you are looking for. The downside is you must run the report for a specified date/time range. So if you are not sure when the event happened it will require you to run the utility several times until you find the event. Note that the output from this utility can be very large so best to break it up to at least 24hrs at max (depending on the amount of activity on your system). The default is that the Control-M Log is only kept for 2 days. Refer to the Control-M Admin Guide for details how to change this (we have ours set to 45 days).
The biggest advantage of EM Audit is it will give you the ability to use the Control-M Reporting Facility to create reports. (note to run EM Audit Reports, the EM User must have full admin access). We have a requirement that we must keep audit logs for 18mo so we have the EM Audit data kept for that long in the EM Audit and Annotation settings (bottom part of the screen you had). Then when we get a request from the auditors or need to research who performed an event, we can easily use the Reporting Facility to filter down to retrieve the data requested.
The other advantage is if you are running more than one Control-M Server in the EM, all the data is consolidated in one place
3 of 3 people found this helpful
Hi Bruce Scott
Some thoughts about the questions.
if Audit and annotation for Scheduling definitions and active network option is not enabled in EM , is there a other way to find out the user action in AJF(like hold, free , rerun) and in Scheduling definitions(delete job/folder)?
User actions in AJF(like hold, free , rerun):
logdate between '20191020' and '20191021' --DATE IN/DATE OUT --YYYYMMDD
and msgid in ('5401','5402','5403','5404','5405','5409','5410','5411','5412')
--01 HELD, 02 FREE, 03 DELETED, 04 RERUN, 05 CONFIRMED, 09 KILLED, 11 SET TO OK, 12 BYPASS
order by logdate, logtime desc
Scheduling definitions(delete job/folder):
SELECT "parent_table", "job_name",
"application", "group_name", "memname", "node_id","change_userid", "change_date", "change_time",
"job_relese", "job_version", "version_opcode", "version_serial", "version_host",
"deletion_timestamp", "deletion_user", "deletion_host", "version_timestamp", "sync_timestamp", "version_user", "sync_type"
deletion_timestamp between '20190901000001' and '20190930235959' --DATE IN/DATE OUT --YYYYMMDDHHMMSS
order by table_id, "parent_table", job_id, version_serial desc
are we able to find out from Control-M server log?
if so, whats the difference between EM Audit logs and Server Audit logs?
CTMLOG DB holds all JOB Lifecycle messages, from ordering to removal from AJF, that includes actions performed on Jobs by EM Users.
CTMEM Audits can be activated to record actions performed not just on Jobs by EM Users but ALL EM Domains.
How hard / easy to find out in Server log?
SQL Query skillset and Control-M Db Schema Guru or BMC Control-M Community Champion Friendship.
I hope you find what you are looking for