Does anyone know if the Business Objects Auditing captures when a report instance is removed by the limit settings? Our Information Governance group wants to know how many are removed by the setting.
In our BI 4.2sp8 version, it doesn’t look to me like this action is audited.
We are on BOE 4.2 SP08 P06, have all auditing options turned on, except Set Event Details > User Group Details.
Auto delete actions are captured in the audit database as “Delete” events, but they don’t seem to be tied back to the parent object. If I search for audit entries based on CUID of the parent document, the delete entries don’t show up. But if I search based on the instance name, I can see them.
User is blank. Application Type shows as ‘Logon without Client ID’. They also aren’t flagged as instances. Didn’t look through all the objects, there may be some other field that identifies them as system deleted due to limits.
Thanks Deb. I’ll take a look at our data and see what I can do with it.
Thanks for pointing me in the right direction, @dtolley.
I found that it appears that the instances removed by the limit settings are done by the SYSTEM ACCOUNT user. I was able to use that as a filter.
Created a union query to my instances query based on this SQL
SELECT *
FROM dbo.ADS_EVENT
INNER JOIN dbo.ADS_APPLICATION_TYPE_STR On (dbo.ADS_EVENT.Client_Type_ID = dbo.ADS_APPLICATION_TYPE_STR.Application_Type_ID And dbo.ADS_APPLICATION_TYPE_STR.Language = ‘EN’)
INNER JOIN dbo.ADS_OBJECT_TYPE_STR On (dbo.ADS_EVENT.Object_Type_ID = dbo.ADS_OBJECT_TYPE_STR.Object_Type_ID And dbo.ADS_OBJECT_TYPE_STR.Language = ‘EN’)
INNER JOIN dbo.ADS_STATUS_STR On (dbo.ADS_EVENT.Status_ID = dbo.ADS_STATUS_STR.Status_ID And dbo.ADS_EVENT.Event_Type_ID = dbo.ADS_STATUS_STR.Event_Type_ID And dbo.ADS_STATUS_STR.Language = ‘EN’)
WHERE dbo.ADS_EVENT.Event_Type_ID = 1006
And dbo.ADS_EVENT.User_Name = ‘SYSTEM ACCOUNT’
And dbo.ADS_EVENT.Start_Time Between ‘2022-01-01’ And ‘2022-01-31’
– Filter out Probes, Object Packages, LCMJob, Program
And dbo.ADS_EVENT.Object_Type_ID Not In (‘AUeG.zBP8cNJp65DYka.YJA’, ‘AafS60mXMNlMv86vS0DuroU’, ‘AYyXz06XTMZJv75L4Qultlc’)
It may be over-reporting a little bit but it is close.
Good to know about the system account showing up. I’m using the audit unx, will look and see why it’s not picking up the name.
