idea Re: QEM audit trail logs - Status changed to: Open - Collecting Feedback in Suggest an Idea

QEM audit trail logs

Prabodh — Mon, 10 May 2021 19:55:29 GMT

Hello team,

We have security policy requirement where we want to track the user activity in QEM. This activity should be logged to a centralized and immutable destination. I have cheked teh enhancement and the solution proposed in https://community.qlik.com/t5/Suggest-an-Idea/QEM-Audit-Log-Automation/idc-p/1805995.

However, the solution looks cumbersome to me. It would require us to configure a separate module to read the audit logs from API and ship it to centralized log repository.

This information is already logged to <Enterprise Manager installation folder>\data\AuditTrail\audit_service location, however is not readable. I would like to request an enhancement to make this plaintext and readable OR simply log this information to the general Enterprise Manager log file.

Most logging tools like Elastisearch, Splunk, Cloudwatch and other provide log forwarding capabilities. I can simply hookup a filebeats agent or logstash to ship the audit log file to Elasticsearch for further analysis.

Thanks!

Re: QEM audit trail logs - Status changed to: Open - Collecting Feedback

Shelley_Brennan — Mon, 14 Jun 2021 12:30:17 GMT

Thank you for the suggestion. We will continue to collect feedback from others as well.

Re: QEM audit trail logs

igorf — Thu, 14 Jul 2022 13:10:48 GMT

We have the same requirement to ship audit log to centralized security system and it would be much more efficient to do it directly through the file reading agent on the server rather then through integration via QEM API

Re: QEM audit trail logs

RogerBeanPool — Mon, 17 Apr 2023 13:50:42 GMT

I agree with the OP. Reading the audit records via a log management utility would be great.

From now on, please track this idea from the Ideation por...

Meghann_MacDonald — Wed, 02 Aug 2023 15:57:13 GMT

From now on, please track this idea from the Ideation portal.

Link to new idea

Meghann

NOTE: Upon clicking this link 2 tabs may open - please feel free to close the one with a login page. If you only see 1 tab with the login page, please try clicking this link first: Authenticate me! then try the link above again. Ensure pop-up blocker is off.

Re: QEM audit trail logs - Status changed to: Closed - Archived

Ideation — Wed, 02 Aug 2023 15:57:15 GMT