# HP OpenView Service Desk

## version 4.5
Enhanced Auditing

October 2004

© Copyright 2004 Hewlett-Packard Development Company, L.P.

## Contents:

Last-minute information
Introduction
Getting Started
Known errors and limitations

## LAST-MINUTE INFORMATION

There is no last-minute information.

## INTRODUCTION

The extended auditing feature has been implemented that takes care of auditing of all administrator console items, user logon/logoff and deletion of history lines. Any user who has the auditor role assigned can configure, export and view the audit log. This auditor role can be assigned to a user by the system administrator.

## Getting Started

As mentioned auditing is created so that only users with a specific role can see auditing. That is why, when the System Administrator logs in into Service desk there does not appear to be any extra functionality. The way to setup auditing is to have the System Administrator create or modify a user (i.e. Auditor) and assign the Auditor role to this user. When this user then logs in, the Auditing part of Service Desk is shown.
Note. Initially Enhanced Auditing is paused and needs to be resumed before it is possible to configure Enhanced Auditing. Please refer to Configuration on how to resume Enhanced Auditing.

When a user, that has only the auditor role, opens the administrator console, the screen in Figure 1 is shown.

Figure 1

There are two items that can be opened:

- Audit Log;
- Configuration;

Because the audit log information cannot be deleted, it is only possible to archive the audit information. See the Archiving section for more details.

### Audit Log

When selecting the Audit Log the Screenshot 2 The Audit Log screen is shown. This window has standard Service Desk behavior. This means that columns can be sorted by clicking on their header and the view can be customized, filters can be added, etc.

Screenshot 2 The Audit Log

By double clicking on one of the items, the details of the specific Audit Entry can be viewed, see Screenshot 3 Audit Log details.

Screenshot 3 Audit Log details

### Configuration

Enhanced Auditing can be configured on an item by item basis. See Screenshot 4 Enhanced Auditing configuration.

Screenshot 4 Enhanced Auditing configuration

When right clicking on the root of the tree (hp OpenView service desk) the whole Auditing feature can be paused or resumed. See Screenshot 5 Pausing and resuming auditing. This is also useful when you want to halt Auditing but actually don’t want to clear your current Auditing configuration, for example when using ACES because the combination of ACES and the Enhanced Auditing feature can cause problems.

Screenshot 5 Pausing and resuming auditing

Note. Deletion is never audited unless one or both of the options ‘Item deletion’ or ‘Deletion of History Lines’ is checked.

### Archiving

Audit entries cannot be deleted within Service Desk. They can only be archived. This is done with the Archiving functionality of Service Desk. An Auditor can open the System Panel and can select Archiving. See Screenshot 6 The System Panel for an Auditor.

Screenshot 6 The System Panel for an Auditor

When opening the Archive Settings, an Auditor can only see items related to Archiving. See Screenshot 7 Archive Settings for an Auditor.

Screenshot 7 Archive Settings for an Auditor

On the Location tab, the archive settings can be amended. By selecting the ‘Use Subfolder For Each Item’ setting the archive process logs to a specific folder which can be protected by the Operating System. Note that if a user amends any setting in this page, this setting is valid for all items which can be archived. By changing the ‘Archive File Name’ setting the Audit Log can always have a unique name.

To start archiving, press ‘Start Archiving now…’ on the button panel. This starts archiving the views the current logged in user has access to. So if a user had Administrator rights and Audit rights, all views selected for Archiving are exported. If a user only has Auditor rights only the Audit view is archived if selected.

## KNOWN ERRORS OR LIMITATIONS

This Auditing feature might not work in relation with ACES; it is recommended to paused auditing while performing ACES actions, and resuming this auditing afterwards.