Auditing changes in SCOM
I have no way to know who made what changes in the SCOM environment. There are multiple admins and they change settings such as Install MPs/ Remove MPs/ Change Overrides/ Author new rules/ Change Admin settings/ Create new users/etc. There is never a way to know who did what.
This is a feature request to Audit all major changes to the SCOM environment.
Please allow for more than Azure Log analytics as a audit source. Some environments are in a isolated network where this option is not possible at all.
Please add auditing. Leaders often compare this to ScienceLogic's EM7 where they audit every single action and click. Audits should be track what you clicked on, and what action or tasks was trigger and where that tasks went and end results of that tasks.
This would be a welcome addition to SCOM as we service multiple environments.
The points from Sergey Mukhin are indeed the kind of information we as SCOM administrators would like to see for auditing the actions our customer teams perform.
Ramu Chittiprolu commented
+1. Audit feature for rules/monitors and overrides is must.
Please add this feature. This is helpful in an environment where everyone needs to have access to everything. In the current security focus world, the lack of auditing makes SCOM look very outdated.
I agree, auditing on SCOM is a must, with multiple hands on a single SCOM solution it is impossible to see who made what changes.
It is strange that you can not audit Admin's work on a system as it can have detrimental effects on the clients environments
I would give this 100+ votes. It is really important to know who actually closed or changed the status of an alert. I know SCOM has covered this issue partially, but there is a special case where a user resets a monitor status, hence related alert(s) appears to be closed by "System". If this alert is "Failed to Connect to Computer", the monitor will never run again.
Ideally this should be written to log in which we could our log aggregation and analytics tool (our is Splunk) to ingest and store this data so we have it for trending, history, security, etc.
Can we have another column in every view, table, or list that indicates who made changes and when?
+1 , now we have only overrides report..
There should be a log of every changes made by who, when, where, before and after changes.
I agree, not only see what changes have been made but also have the function to delete the "change" and have the settings restored.
Sergey Mukhin commented
e) access rights to views
f) group members
g) resource pool members
h) User roles
i) discovery rules for network devices
j) approved agents
f) switched instance(s) to maintenance mode?
Wilson Wong commented
There should also be a way to track and audit SCOM console/web console usage. My management has often asked for a way to validate that IT Staff is actually looking at SCOM data so they want to see how often and for how long people are on the SCOM consoles.