Auditing changes in SCOM
I have no way to know who made what changes in the SCOM environment. There are multiple admins and they change settings such as Install MPs/ Remove MPs/ Change Overrides/ Author new rules/ Change Admin settings/ Create new users/etc. There is never a way to know who did what.
This is a feature request to Audit all major changes to the SCOM environment.
Henrik Nørgaard Hansen commented
Adding a Windows event log entry for changes in the setup of monitoring in SCOM isn't a workable solution IMNSHO.
Would the events be logged on each and every Management Server? Or only on the workstation where the changes were performed? If the event is only logged locally on the workstation how can I ensure that it is collected for reporting without having an agent on each and every workstation?
I suggest logging these changes to the SCOM database(s). I suggest a new data table with containing these entries. Of course only the most recent would be available in the OperationsManager database but all data would be stored in the data warehouse. Perhaps in a manner quite similar to how events are being handled already?
Reporting could consist of a simple report allowing a choice of period, the nature of the change (add/rename/delete), the kind of object involved (monitor, rule, discovery etc.), the account that performed the change, etc.
Thanks all for your votes. We are evaluating this feature and the scope for now is to audit MP changes. Any changes to Rules, Monitors, Object discoveries, Groups, MP import/create/delete will be logged in the event viewer. If you want to create reports then we will provide a way to send these event logs to log analytics for easy reporting. Please share your comments/thoughts on this.
Please allow for more than Azure Log analytics as a audit source. Some environments are in a isolated network where this option is not possible at all.
Please add auditing. Leaders often compare this to ScienceLogic's EM7 where they audit every single action and click. Audits should be track what you clicked on, and what action or tasks was trigger and where that tasks went and end results of that tasks.
This would be a welcome addition to SCOM as we service multiple environments.
The points from Sergey Mukhin are indeed the kind of information we as SCOM administrators would like to see for auditing the actions our customer teams perform.
Ramu Chittiprolu commented
+1. Audit feature for rules/monitors and overrides is must.
Please add this feature. This is helpful in an environment where everyone needs to have access to everything. In the current security focus world, the lack of auditing makes SCOM look very outdated.
I agree, auditing on SCOM is a must, with multiple hands on a single SCOM solution it is impossible to see who made what changes.
It is strange that you can not audit Admin's work on a system as it can have detrimental effects on the clients environments
I would give this 100+ votes. It is really important to know who actually closed or changed the status of an alert. I know SCOM has covered this issue partially, but there is a special case where a user resets a monitor status, hence related alert(s) appears to be closed by "System". If this alert is "Failed to Connect to Computer", the monitor will never run again.
Ideally this should be written to log in which we could our log aggregation and analytics tool (our is Splunk) to ingest and store this data so we have it for trending, history, security, etc.
Can we have another column in every view, table, or list that indicates who made changes and when?
+1 , now we have only overrides report..
There should be a log of every changes made by who, when, where, before and after changes.
I agree, not only see what changes have been made but also have the function to delete the "change" and have the settings restored.
Sergey Mukhin commented
e) access rights to views
f) group members
g) resource pool members
h) User roles
i) discovery rules for network devices
j) approved agents
f) switched instance(s) to maintenance mode?
Wilson Wong commented
There should also be a way to track and audit SCOM console/web console usage. My management has often asked for a way to validate that IT Staff is actually looking at SCOM data so they want to see how often and for how long people are on the SCOM consoles.