Find admin which gave user access to QlikView document

[MartijnWanders]

Hi all,

My customer ask where he can find the person who gave a user access to a specific QlikView document.  I found this information: https://help.qlik.com/en-US/qlikview/May2022/Subsystems/Server/Content/QV_Server/QlikView-Server/QVS...

In the Management Audit Logs we can not find who gave access. The only thing we can see who deleted the user form access.

Have somwbody a clue because I can not find anything about this. Thank you!

[marcus_sommer]

That the deleting of access-rights is logged but not the allowing it's not logically. Did you try to give an access to a complete new dummy-app and then removing the access again? If this worked (means the measures are logged) it should have worked in the past, too and means that the old permission entry might be gone anyway. 

[Maria_Halley]

@MartijnWanders 

I did a quick test, and I get all changes in the DistributionDetail log. The DistrubutionDetail log, uses TaskID as identifier, so I used the DocumentTask log, to search for the distribution task name to get the ID.

[MartijnWanders]

@Maria_Halley Thank you for this direction. If i look in the logfile then the date jumps from 2022_01_20 to 2023_03_10.

Does this means there are no changes made in between? 

[Maria_Halley]

@MartijnWanders 

It's difficult to know for sure, either no changes or log turned off.

Was the user rights changed during the time there were no log entries? Or did you get the info you needed from the log?

The QVPR should also have the change information, but only the latest change. But if you have backups, you could find when the user rights changed, unless there where another change to the task the same day. 

[MartijnWanders]

Hi @Maria_Halley ,

I think it's changed in the missing period. But, my shared information is coming from the QVPR location in the ManagementService folder. I can not find another DistributionDetal Log file.

Do I have to search somewhere else?

[Maria_Halley]

@MartijnWanders 

I was in the audit log. But if the QVPR has not been updated, your configuration would reset. 

There is the possibility that someone changed the rights to the qvw directly on disk.

But that would be overridden in the next distribution, and you can't see it in the QMC. 

[MartijnWanders]

Hi @Maria_Halley ,

I don't see the auditlog folder. I don't think you mean the Log folder? This one have only a small logfile per day.

Maybe it's deleted somewhere in the past.

 

[Maria_Halley]

@MartijnWanders 

The audit logging has to be turned on in C:\Program Files\QlikView\Management Service\QVManagementService.exe.config.

You also define the path there. Sorry for the confusion. 

[MartijnWanders]

Hi Maria,

Thank you for the information. I have the feeling that the AuditLog isn't active at my customer. So that means no data about this.