Tracking changes to director

[jasonmichel]

Is there a log file that keeps track of configuration changes made in shoreware director? Have an employee that supposedly made some changes and want to see what was done.

[benchtoplabs]

There is a Director Utilities Log file under c:\shoreline data\logs, but it is pretty cryptic. If you combine the timestamps of when they logged in, (Look in the Application Log on the windows box) and this file, you can come up with some idea of what they changed. It won't show the before/after data, but it will at least show you what pages they modified and clicked save on.

[mousenut]

Is there a syslog event filter that can be purchased somewhere to decipher this stuff? We have an audit issue now and not having plain english director change log is causing us a real headache.

[jlynne22]

what is the exact name of the log file?

[Palitto Consulting]

Director-YYMMDD.HHMMSS.log

[JamieBridges]

Is there a syslog event filter that can be purchased somewhere to decipher this stuff? We have an audit issue now and not having plain english director change log is causing us a real headache.

Not that I'm aware of. Perhaps ShoreTel P.S could help on that one.. :whistling:

Thanks,
Jamie

[jlynne22]

It's not secure, those text files can be modified at anytime. Anyone know of a solution for tracking all modifications to it?

[Palitto Consulting]

Don't give them write access to that text file. In fact, don't even give them access to the box unless they need reports, and in that case, use a limited user account.

[Logan1985]

You could always look into something like OSSEC which will monitor changes to files you specifiy..then you know when a chagne has been made. This however is not entirely trivial, but if you have the skills to do it in-house then it's a good tool.

Also if you need more accountability then don't let everyone use the admin account - create additional accounts for your admins. Way easier to track down..

[ctrl_alt_del3t3]

did you ever find a solution for this? I am looking to audit changes as well

[mikeyb123]

We used a product called in my last job called SAMS - highly effective in tracking everything. even to the point where your admins don't need to know the passwords to do stuff.

http://www.datatrackplc.com/remote-administration/products/sams.html

might be that it's a step too far but works for RDP, web, ssh telent etc.