Configuring Audit Event Recording
Out of the box, Windchill records:
• System usage (Login, Logout)
• Organization usage (Context Logon)
• Cross Site Request Forgery events
• Download events (Download, View Representations)
• License usage (Login Denial)
Any other specific events that you want recorded in the audit log must be enabled on an individual basis.
The auditing configuration file (<Windchill>/conf/auditing/configAudit.xml by default) determines which events are recorded for which object types. The configuration file is delivered with some predefined service events and summary events that can be captured and reported on. You will need to analyze your company's auditing rules to determine which specific events you want audited. By enabling only specific events, you thereby minimize the size of the audit log by preventing all events from automatically accumulating in the audit log. After adding, changing, or enabling additional events, restart your method server for the updates to take effect.
 |
Administrators need to weigh the benefits of greater security, such as enabling an audit event that can alert you to potential malicious activity, against optimized performance for your system. The extent to which security measures affect performance depends on many factors that are unique to your system. Impact could be minimal, but if performance concerns result from enabling an audit event, you have the option of disabling it, including any that are turned on out of the box.
|
In the configuration file, events are either specified as eventKey or eventType, depending on how they are executed in Windchill. The following table shows the event name as it appears in Windchill and the eventKey as it appears in the configAudit.xml file.
|
Event
|
eventKey
|
|---|---|
|
Add Role to Context Team
|
wt.inf.team.ContainerTeamServiceEvent/ADD_ROLE
|
|
Add Role to Life Cycle Team
|
wt.team.TeamServiceEvent/ADD_ROLE
|
|
Add Role to Organization
|
wt.inf.team.NmOrganizationServiceEvent/ADD_ROLE
|
|
Associate
|
wt.audit.AuditServiceEvent/ASSOCIATE
|
|
Change Implementation
|
wt.change2.ChangeService2Event/CHANGE_IMPLEMENTATION
|
|
Change Life Cycle State
|
wt.events.summary.ChangeLifecycleStateSummaryEvent
|
|
Check In
|
wt.events.summary.CheckinSummaryEvent
|
|
Check Out
|
wt.events.summary.CheckoutSummaryEvent
|
|
Complete
|
wt.events.summary.CompleteSummaryEvent
|
|
Context Logon
|
wt.inf.team.ContainerTeamServiceEvent/CONTAINER_LOGIN
|
|
Copy
|
wt.events.summary.CopySummaryEvent
|
|
Cross Site Request Forgery
|
wt.audit.AuditServiceEvent/CSRF
|
|
Deadline Change
|
ptc.projectmanagement.plan.ProjectManagecomentEvent/EPP_DEADLINE_CHANGE
|
|
Delete
|
wt.events.summary.DeleteSummaryEvent
|
|
Disassociate
|
wt.audit.AuditServiceEvent/DISASSOCIATE
|
|
Download
|
wt.content.ContentServiceEvent/READ_CONTENT
|
|
Edit Access Control
|
wt.events.summary.ModifyObjectAccessSummaryEvent
|
|
Edit Attributes
|
wt.events.summary.ModifySummaryEvent
|
|
Edit Content
|
wt.events.summary.ModifyContentSummaryEvent
|
|
Edit Identity
|
wt.events.summary.ChangeIdentitySummaryEvent
|
|
Edit Team
|
wt.events.summary.ModifyTeamSummaryEvent
|
|
Export
|
wt.events.summary.ExportSummaryEvent
|
|
Finish Date Change
|
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_FINISH_CHANGE
|
|
Health Status Change
|
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_STATUS_CHANGE
|
|
Import
|
wt.events.summary.ImportSummaryEvent
|
|
Login
|
wt.session.SessionUserAuditEvent/login
|
|
Logout
|
wt.session.SessionUserAuditEvent/logout
|
|
Markup and Annotate
|
wt.events.summary.MarkupAnnotateSummaryEvent
|
|
Modify Access Policy
|
wt.events.summary.ModifyAccessPolicySummaryEvent
|
|
Modify Product Structure
|
wt.events.summary.ModifyProductStructureSummaryEvent
|
|
Modify Security Labels
|
wt.events.summary.ModifySecurityLabelsSummaryEvent
|
|
Move
|
wt.events.summary.MoveSummaryEvent
|
|
New Object
|
wt.events.summary.CreateSummaryEvent
|
|
New View Version
|
wt.events.summary.NewViewVersionSummaryEvent
|
|
One Off Version
|
wt.events.summary.OneOffVersionSummaryEvent
|
|
Owner Change
|
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_OWNER_CHANGE
|
|
PDM Checkout
|
wt.sandbox.SandboxServiceCheckoutEvent/POST_SB_CHECKOUT_EVENT
|
|
Percent Complete Change
|
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_PERCENT_CHANGE
|
|
Preference Change
|
wt.preference.PreferenceServiceEvent/POST_UPDATE
|
|
Purge
|
wt.vc.VersionControlServiceEvent/PRE_ROLLUP
|
|
Remove Role from Context Team
|
wt.inf.team.ContainerTeamServiceEvent/REMOVE_ROLE
|
|
Login Denied – Insufficient ADU License
|
wt.session.SessionUserAuditEvent/LoginDenied_InsufficientADULicense
|
|
Login Denied – License Unassigned
|
wt.session.SessionUserAuditEvent/LoginDenied_LicenseNotAssigned
|
|
Remove Role from Life Cycle Team
|
wt.team.TeamServiceEvent/REMOVE_ROLE
|
|
Remove Role from Organization
|
wt.inf.team.NmOrganizationServiceEvent/REMOVE_ROLE
|
|
Revise
|
wt.events.summary.ReviseNewVersionSummaryEvent
|
|
Risk Change
|
com.ptc.projectmanagement.plan.ProjectManagementEvent/EPP_RISK_CHANGE
|
|
Search
|
com.ptc.windchill.enterprise.search.server.searchaudit.SearchAuditEvent/SEARCH_AUDIT_EVENT
|
|
Security Label Download Acknowledgment
|
wt.audit.AuditServiceEvent/SECURITY_LABEL_DOWLOAD_ACK
|
|
Sent To Print
|
wt.representation.SentToPrintEvent/SENT_TO_PRINT
|
|
Share
|
wt.events.summary.ShareSummaryEvent
|
|
Undo Checkout
|
wt.events.summary.UndoCheckoutSummaryEvent
|
|
User Password Change
|
wt.org.OrganizationServicesEvent/PASSWORD_CHANGE
|
|
View Properties
|
wt.audit.AuditServiceEvent/VIEW_PROPERTIES
|
|
View Representations
|
wt.representation.ViewEvent/VIEW
|
The following table shows the event name as it appears in Windchill as well as the eventType and the event entry as they appear in the configAudit.xml file. These are non-generic type of events.
|
Event
|
eventType
|
Event Entry
|
|---|---|---|
|
Due Date Change (Classic)
|
DEADLINE_CHANGE
|
ProjectManagementEventEntry
|
|
Finish Date Change (Classic)
|
FINISH_CHANGE
|
ProjectManagementEventEntry
|
|
Health Status Change (Classic)
|
STATUS_CHANGE
|
ProjectManagementEventEntry
|
|
New Discussion
|
NEW_DISCUSSION
|
ForumEventEntry
|
|
Not Authorized Access
|
NOT_AUTHORIZED
|
AccessControlEventEntry
|
|
Owner Change (Classic)
|
OWNER_CHANGE
|
ProjectManagementEventEntry
|
|
Percent Complete Change (Classic)
|
PERCENT_CHANGE
|
ProjectManagementEventEntry
|
|
Rollback Iteration
|
POST_ROLLBACK
|
VCEventEntry
|
|
State Change (Classic)
|
STATE_CHANGE
|
ProjectManagementEventEntry
|
|
Workflow Activity State Change
|
ACTIVITY_STATE_CHANGED
|
WfEngineEventEntry
|
|
Workflow Activity Variable Change
|
ACTIVITY_CONTEXT_CHANGED
|
WfEngineEventEntry
|
|
Workflow State Change
|
PROCESS_STATE_CHANGED
|
WfEngineEventEntry
|
|
Workflow Variable Change
|
PROCESS_CONTEXT_CHANGED
|
WfEngineEventEntry
|
For a full description of all events, see the related topics listed below.
If you choose to enable additional events, add, or change the out-of-the-box auditing rules, PTC recommends that you follow the maintenance best practices for modifying PTC files as described Managing Customizations. Using the best practices, you create a backup of the original and apply your changes to a new file.