Change Tracking - The Log

I'm often asked "Where is the Change Tracking log stored?" The answer is simple:

The Change Tracking log is stored alongside the ISA configuration it documents.

The ISA configuration is stored in the local registry (Standard Edition) or in the CSS (Enterprise Edition). The Change Tracking log is stored in there too, as a VPS (Vendor Parameter Set). In Standard Edition, there is only one log. In Enterprise Edition, there can be several:
• One log for each array
• One log for the whole enterprise
• One log for each enterprise policy.
Every change is noted only in the log it's relevant in*.

 

When you look in the Change Tracking tab of the ISA Management monitoring node, you see a combination of:
• The log for the current array
• The enterprise log
• The log for the enterprise policy assigned to the array.

You can tell which entry comes from where by looking at the "Array" column:

 

Note that if you make one change in, say, both array and enterprise, then it will be split into 2 entries, each documenting the relevant part and stored in the relevant log:

 

Now you know why, if you create a new array, you don't see it in Change Tracking: You need to look in the Change Tracking tab of that new array. Same with a new enterprise policy: You can only see it if you look in the Change Tracking tab of an array which is assigned to the new policy. For fun**, you can change the policy assignment of an array, not even bother to apply, and look at the Change Tracking tab - it will show the new policy log!

Unfortunately, ISA Enterprise Edition doesn't have built-in enterprise monitoring, so you can't see the change logs of all arrays/etc on one screen. But no fear: In a future post, I will show a sample of an enterprise change log viewer. Stay tuned…

 

* There's one exception: If you delete an array or an enterprise policy, this deletion will be marked in the one enterprise log. This is because the array's/policy's change log is deleted with the array/policy itself, and we want to leave at least some hint about what happened.
** Or at least, certain people's definition of fun.

 

-Jonathan Barner, ISA Sustained Engineering Team

Comments

• Anonymous
  January 01, 2003
  Hi I want to konw how to export the change tracking log or where can i find the file,i want to another application to read it, such as a monitor software

• Anonymous
  October 04, 2010
  i'm running standard and i don't see a "change tracking" tab in monitoring. i have alerts, sessions, connectivity verifiers, services, and configuration tabs.

• Anonymous
  January 12, 2011
  I am not seeing an "Array" column, in my Change Tracking, and no one can see changes I made as Schema Admin, not even other Schema Admins.

• Anonymous
  January 24, 2014
  Any idea about - how to export the change tracking log?