How to save change log history for many years

Good morning to all,

i do have a AR Server 8.1.3 running for around 1k people. As it is configured in default the change history is usable for 30 days.

I am struggling to activate the History DB (replication). The requirement we have is that all changes (especially group membership changes) will be tracked and saved for around 10 years. 

We do have 1 AR Server with Sync and one SQL Server for the data.

Can you tell me if and how we can achieve this goal?


Regards,

Michael

  • Change History is a great short term operational and to a degree, security tool but I don't recommend using it as a long term archive for events.

    Rather, save the Administration Service's Windows Event log.

    That way you can more efficiently use third party tools to mine the data.

    As for the data you have, I would look to backup (i.e. make an offline copy of) the existing management history database and then perhaps engage someone (Quest/One Identity PS or Partner consultant) to help you to purge the events you don't need.

  • I really don't recommend doing this.

    Active Roles is not intended to be used as a long-term auditing tool.

    The Active Roles Management History database is not an archive of changes made. It is the operational database for the product. It's primary use is not as a report or audit - it's where the changes are actually being made.

    This means that the size and complexity of the Management History database directly impact the performance of the product.

    You should look at archiving the events using either the built-in Event Viewer logs archival options or a real audit tool like Change Auditor or Spunk.

  • To add to what the other two gentlemen have already provided, in case you're not aware, there is a tool that is included in the Active Roles installation media - though it is a separate install - called the Collector. One of the purposes of this tool is to gather the Active Roles event logs (from all AR servers) into a single database (completely separate from all other Active Roles databases). You then have the ability to use SQL Reporting Services-based reports (deployable from within the Collector) to run reports against this database.

    Obviously this is a bit old-school, but for event collection, it is serviceable. Obviously if you have a tool like Splunk or InTrust, you would be better off, but this will work if you don't have budget for additional tools.