Best Approach to Archive Audit Log in Saviynt

[IDAM09]

Hi, 

We have a requirement to archive the Audit Logs beyond 90 days in Saviynt for future reference.

Would be interested in knowing the report configuration to achieve this. I have created a report with the below SQL Query: 

select ua.TYPEOFACCESS as 'Object Type',ua.ActionType as 'Action Taken',u.username as 'Accessed By', ua.IPADDRESS as 'IP Address',ua.ACCESSTIME as 'Event Time',ua.DETAIL as 'Message' from users u , userlogin_access ua, userlogins ul where ul.loginkey = ua.LOGINKEY and ul.USERKEY = u.userkey and ua.Detail is not NULL

The query is fetching all the records older that 90 days from the current environment. Hence, I trying to understand what should be the schedule and configurations to be done in the report to archive the logs from the audit table and retain it for 3 years.

Thanks.

[rushikeshvartak]

You can run every 30 days and enable archival on report

[IDAM09]

From the Saviynt documentation, I read that the data will be purged from Database every 90 days, but the report is fetching records older than 90 days. Any other configurations to be made?

I was thinking to execute the report every 90 days so that each report has the latest audit records but I could see entries older to 90 days. 

[rushikeshvartak]

Archived report can be fetch for longer time

[IDAM09]

Any idea how to fetch the incremental records and archive it? 

For the 1st run we fetch all the records and archive it. Then, fetch only the incremental records every 90 days. What values for the Base Count and No of History values be correct for our scenario?

[rushikeshvartak]

use Base count config under report

Base Count

Specify the count from when the number of records to display as delta or difference between the number of records available before the run and records newly added after the run. This is useful because to prevent the overhead to display all the records each time continuously. Let us understand this through the below examples where Base Count is set as 3. Base count is set to 3 for the following example use case. First run - > number of records fetched is 10. Hence, base set is set to 10 records. New records are added after first run : 2 records added Second run - > number of records to be shown will be 2, which is delta from current run (12) - previous run base set (10) = 2 New records are added after second run : 5 records added Third run - > number of records to be shown will be 5, which is delta from current run (17) - previous run base set (12) = 5 Now, as per the Base Count configured which is 3 in this example, the base set is set to 17 after 3 runs. Before the fourth run, 3 more records are added. Fourth run - > number of records to be shown will be 3, which is delta from current run (20) - previous run base set (17) = 3 Starting with Release v23.1, while creating analytics controls, the Base Count value must be less than or equal to the Number of History to Keep value. The Base Count is applicable only when you select the Save Data check box in the Where do you want to save your data? field is selected. However, if you had selected Send Email As Attachment or Save To File check boxes but had not selected the Save Data check box, the Base Count will not be applicable and the control execution will return full data in every run.

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter17-EIC-Analytics/Managing-An...

[IDAM09]

@rushikeshvartak Thanks for your response.

On Enabling Archival, I can see the reports are archived as expected. Is this archived file retained upto 3 years as per the documentation? 

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter07-General-Administrator/Arc...

[rushikeshvartak · Accepted solution]

Yes