Capturing controller user configuration changes as an event

[Sundarapandian.Ponniah]

Hello,

We have a requirement to send out an email notification or alert whenever there is any change made to the application configuration by an user (eq: when someone enables data collector in an App). Is there anyway we can capture these user changes through an event ?  Please advise

Thank you,

Sundar

[Atyuha.Pal]

Hi Sundar,

There is no such way to create event on enabling data collector.

 An event can represent an error or exception generated by the application, the crossing of a performance threshold, or an operational change in the application, such as a JVM restart.

Please refer to the below doc and check of it helps

https://docs.appdynamics.com/display/PRO43/Monitor+Application+Change+Events

https://docs.appdynamics.com/display/PRO43/Monitor+Events

Thanks,

Atyuha

[Sundarapandian.Ponniah]

Thanks for the response, Atyuha

I'm aware of the events you are talking about. But, the requirement is to capture the user config changes, especially around data collectors. AppDynamics can capture PII informations by enabling data collectors or sql bind variables which is really sensitive, and the inability to even trace who enabled data collectors to capture those information in a Prod env could lead to lot of questions around data security and prevention.

[Atyuha.Pal]

Hi Sundar,

If it is a onpremise controller. Could you please log in to controller database and run the below query to get the information on configuration changed by an user. I have created and deleted data collector and checked in audit table and can see all the details reagarding this. Please refer to the attched screenshots for reference.

select * from controller_audit order by ts_ms desc limit 20;

Thanks,

Atyuha

[Michael.Horstmann]

Sundar,

You can log into the administrator console and provide yourself a daily audit report, which you can define to include changes like these or at least in part to a somewhhat accountable degree.

To accomplish this, you can go to your controller's url and change the "/#/" in the routing to "/admin.jsp/" for example if oyur controller is at "https://123.456.789.1:8090/controller/#/etcetcetc"  you will replace the hashtag with "admin.jsp" as "https://123.456.789.1:8090/controller/admin.jsp" and that will take you to the root admin login.  You will be able to tell you're in the correct place because only the password will be requested at the login form, you are bound to "root" as user at this address.  Once logged in you will see all your controller configurations, at this point change "/admin.jsp/" to "main.jsp" and you will view your controller's AppD interface UI.   Go to "Dashboards and Reports" and you can configure a basic "controller audit" where "application changes" can be monitored as a standard event type.

This may not be EXACT, but it will let you know who logged in and made application changes and when.  If, in your event you're finding people are sabotaging your work, committing changes without accountability, or just making uninformed changes they will be logged "to some degree" by user and time frame at very least.

I have attached 2 images, one to show the url for admin.jsp as it is with ours and a second to show the criteria you would want to assign to your ROOT loign which will tell you when overall application configuratiosn have changed, when a bad config has been launched, or when someone is in general making unapproved changes.  This may not be EXACTLY what you want to a high level of detail, but it should take you 90% of the way and give you good grounds to create a formal structure of accountability when your "sub-admins" make unapproved changes you are then held responsible for.