GroupWise has no ability to track/ audit GroupWise Administrative Changes - System Wide - with Sentinel or other event management tools. This is a real urgent requirement.
by: Leandra S. | over a year ago | Administration
Micro Focus Enhancement Requests Portal is moving. We are migrating the IDEAS from this site to the New Idea Exchange on May 6th. For more information on the new Idea Exchange please visit the Community FAQs.
Votes
61
Ability to track/ audit GroupWise Administrative Changes - System Wide - with Sentinel or other event management tools
by: Leandra S. | over a year ago | Administration
Comments
Yes. Who did what when from where (IP address of admin browser session)
I particularly need to be able to see if a message retention flag was un-set on a mailbox (for example).
Even without directing them to a SIEM solution, we need a way to have the GW-Admin console log who logged in and from where.
To be able to track who made the changes that are logged in
/var/log/novell/groupwise/gwadmin/gwadmin-console.log
?
Usually only failed logins show in that file, and are a bit cryptic
a non-admin with correct credentials has the same report as a non-admin
without correct password.
2016-11-15 13:11:50 GwAuthenticationProvider [ERROR] ***Failed to Login
**** No admin rights
bogus IDs that don't exist in the system only show as failed login
2016-11-15 13:12:03 GwAuthenticationProvider [ERROR] ***Failed to Login
**** Not allowed
At least the user names of failed/blocked logins are shown in gwadmin-
service.log, but we still can't tell who did what.
Reiterating this request: apparently, I have a help desk person un-setting the message retention flag on some mailboxes (which could get us in a boatload of legal trouble), but I cannot tell who is doing this. If I knew who was doing this, I could tell them to stop (or take away their administration rights).
This is totally needed, everything is now audited, why not GroupWise ( more secure as Exchange )
Yes, It's a need.........
Please add this auditing features