Group Relevance modified logs

1

Hello All,

There’s an old automatic group in our PROD environment which has a lot of existing actions. Someone modified it. We would like to find out who did it and when ?

Thanks in Advance.

2

If it’s logged (I’m not sure if it’s one of the activities tracked) you can find any useful information in the Root Server audit log: Configuring logs

3

If you have not yet run the BESAdmin Cleanup tools, you can get each version by identifying the ID of the computer group (may need to right-click the Columns to display the 'ID' field), and then use a direct SQL query:


SELECT *
FROM [BFEnterprise].[dbo].[LOCAL_OBJECT_DEFS]
WHERE ID = 49

Replace the id '49' here with the ID of the computer group you wish to examine.
This should return one row for each tracked version of the computer group - when you edit the group definition a new version is created. Among the fields you can see the 'CreationTime' (when the group was modified) and the Username (which is the masthead operator name of a Bigfix user, i.e. __op_1

Then this query can map the masthead operator name to a username you may recognize:

SELECT [Username]
      ,[MastheadUsername]
FROM [BFEnterprise].[dbo].[USERINFO]