System Log (Audit)
Capture user actions transparent and reliable.
The system log is integrated in the FlowChief system by default and writes a protocol of all actions that have been performed active in the system. Administrators and IT / OT officials can comprehend which actions have been performed by users or system services and at which date and time changes have been inserted. The evaluation is performed by a web interface which requires no further plugins. Incidents can be sorted by period, user, process variable, action type and free search. The existing user interface displays the incidents in a clear overview, sorted by period, user, client and action.
Functionality
The system log contains manual actions and automated procedures of system accounts, services, scheduler, mobile applications and external applications.
The following incidents are included in the protocol:
-
User log on, log off and failed log on attempts
-
Insertion of commands and set point values
-
Acknowledgement of notifications
-
Amendments of process variable properties, stand-by-service, maintenance, scheduling or dashboards
-
Amendments of files and process images
-
Alarm flood detection and signaling tests
-
Automated system and scheduler actions
Failed user log ons are captured with the user, client or IP address (if available) and error reason. Changes to files are documented with user, client, file path and amended properties.
Benefits
-
Gapless traceability
Operations and amendments to the configuration can be traced by user and period.
-
Fast source analysis
Combined filters enable to trace conspicous set point values, log on attempts or system actions.
-
Support of IT / OT security
Unchangeable protocols, indication based on access rights and caption of IP addresses support the internal security and control process.
System events such as set point values and archive value corrections can be analysed chronologically.
Technical Details
| Details | |
|
Properties |
|
|
Captured Information |
Period, user, client or IP address, application or service, action, process variable or tag, PEID, new value and unit |
|
Value changes |
New value in protocol |
|
Timestamp |
Saved in UTC format in seconds, timezone and summer time are considered at presentation |
|
Search and Filter |
Free time range, user, process variable or tag via partial string, free text within action description, action type and placeholder |
|
User interface |
Web based and plugin free user interface, filters can be combined |
|
Storage |
FlowChief archive database |
|
Preservation |
Free settings for preservation, time based outsourcing of older values possible (data will stay visible in user interface) |
|
Backup |
Component of data storage and recovery of the FlowChief system |
|
Integrity |
Protocol content can not be amended or deleted. Secured by database access rights. |
|
Access rights |
Read only rights can be assigned for user groups or individual users and also withdrawed |
|
Automated distribution |
Automated editon and istribution via the FlowChief Reporting Service |
|
SIEM link |
Events can be outsourced via the module FC_Syslog to a SIEM system as of FlowChief version 9. |
|
Licensing |
|
|
System log (Audit) |
Automatically contained in basic FlowChief system |
