audittrail - microsoft azurejpabapriso02.japaneast.cloudapp.azure.com/apriso/... · 2018. 8....

Audit TrailDELMIA Apriso 2019 Technical Guide

®2018

DassaultSystèmes.Apriso,3D

EXPE

RIENCE,theCom

pass

logo

andthe3D

Slogo,C

ATIA,SOLIDWORKS

,ENOVIA,DELMIA,SIMULIA,GEO

VIA,EX

ALEA

D,3DVIA,BIOVIA,NET

VIBE

S,and3D

XCITE

arecommercialtrademarks

orregistered

trademarks

ofDassaultSystèmes

orits

subsidiariesintheU.S.and/orothercountries.Allothertrademarks

areow

nedby

theirrespectiveow

ners.

Use

ofanyDassaultSystèmes

orits

subsidiariestrademarks

issubjecttotheirexpress

writtenapproval.

Contents1 Introduction 41.1 Purpose 41.2 Scope 41.3 Intended Audience 4

2 Audit Trail Overview 52.1 The Purpose of Audit Trail 52.2 Key Audit Trail Terms 52.3 How Audit Trail Works 52.4 Central Configuration 5

3 Audit Configuration Overview 73.1 Audit Configuration Overview 73.2 Audit Configuration Browser 7

4 Audit Configuration Properties 84.1 Header Tab 84.2 Roles Tab 84.3 Audited Tables Tab 94.3.1 Main Table 94.3.2 Additional Tables 10

4.4 Audited Fields Tab 124.4.1 Audited Fields 124.4.2 Audited Field Properties 12

4.5 Audit Conditions Tab 134.6 Key Values Tab 144.7 Common Configuration Mistakes 15

5 Audit Trail Usage 166 References 17

FiguresFigure 1 Audit Configurations browser 7Figure 2 Header tab 8Figure 3 Roles tab 9Figure 4 Audited Tables tab 9Figure 5 Additional Table properties screen – Header tab 11Figure 6 Additional Table properties screen – Additional Table Properties tab 11Figure 7 Audited Fields tab – Audited Field Properties screen 13Figure 8 Audit Conditions tab 14Figure 9 Key Values tab 15Figure 10 Audit Configurations browser 16Figure 11 Audit Trail main screen 16

Audit Trail | DELMIA Apriso 2019 Technical Guide 2

1 Introduction1.1 PurposeThe purpose of this Technical Guide is to provide an overview of the Audit Trail framework in DELMIA Apriso, which is used for configuring and tracking database changes within the DELMIA Apriso system. All of the necessary information on using the framework to its full potential will be presented here. How to perform a common configuration and complete the administration tasks will also be described in detail.

1.2 ScopeThe scope of this document includes these core areas:

Audit Trail architecture and key termsHow Audit Trail worksConfiguration of Audit Trail

Comprehensive explanation of how to create and maintain Audit ConfigurationsExamples of how to create an Audit Trail based on business requirements

Usage of Audit TrailAn overview from the perspective of the end-user who is not involved in administrative tasks, but rather is focused on viewing and filtering Audit Trail

1.3 Intended AudienceThis guide is intended for people who are trained in using and administering DELMIA Apriso Audit Trail to perform basic, day-to-day procedures.


2 Audit Trail Overview2.1 The Purpose of Audit TrailAudit Trail is used to track changes in the database. It enables traceability by logging changes on specified DELMIA Apriso tables and tracking what changes a specific user has made. This historical data is stored for comparison and backup purposes.

The purpose of Audit Trail is to maintain control over all of the changes that have been made to DELMIA Apriso data over time.

2.2 Key Audit Trail TermsAudit Configuration – a configuration that defines which changes to data are monitored and tracked

The database table AUDIT_CONFIGURATION is used to store Audit Configurations (for more information, please see Database Documentation)

Audit Entity – represents a set of data that is consistent, has business meaning, and has been changed

An Audit Entity is built using a definition from the Audit ConfigurationThe database table AUDIT_EVENT is used to store Audit Events (for more information, see Database Documentation)

Audit Event – represents a single database operation on a set of dataAudit Trail – a record showing what database operations the user has performed during a given period of time

An Audit Trail consists of Audit Events

2.3 How Audit Trail WorksAfter DELMIA Apriso has been installed, Audit Trail is disabled by default. It is possible to enable Audit Trail on a table-by-table basis, as there is often the need to only track several specific tables rather than all existing DELMIA Apriso tables (which would severely impede the performance of DELMIA Apriso).

When a specific DELMIA Apriso table has been configured for an audit, all of the changes made to this table by specific users will be stored in the Audit Trail Log.

Only changes made after Audit Trail has been enabled will be stored.

2.4 Central ConfigurationAudit Trail must be enabled in Central Configuration.

There are two settings for Audit Trail that can be set in the DELMIA Apriso Central Configuration. The settings are system-wide and can be overridden on the application level.


The settings are not accessible through DELMIA Apriso Configuration Manager, but they can be edited manually in the Central Configuration file using “AuditEnabled” and “AuditConfigurationAbsouleLifetime” keys located in the “Framework” section of the Central Configuration file (for detail, see Central Configuration Documentation).

An audit generates considerable performance overhead, so it should be enabled only when it is necessary. (When Audit Trail is enabled, the “UpdateBatchSize” flag located in the “DataServices” section is disabled.)


3 Audit Configuration Overview3.1 Audit Configuration OverviewAn Audit Trail is created based on an Audit Configuration. There can be many Audit Configurations in the system.

An Audit Configuration is a user-defined object consisting of fields that are mapped to columns in database tables. One of the tables is considered the Main Table, and value changes in that table can trigger an audit.

During runtime, the Audit Trail uses Audit Configurations to create Audit Entities when data in the database is changed and these changes are supposed to be tracked.

An Audit Entity is an instance of an Audit Configuration that has values for its defined fields. An Audit Configuration may span several tables, and loading additional data from a database may be required before the Audit Trail for a specified Audit Configuration can be persisted.

Finally, an Audit Event that contains an Audit Entity is persisted in the database.

Audit Configurations are maintained using a set of screens that can be accessed in the DELMIA Apriso Desktop Client.

3.2 Audit Configuration BrowserThe Audit Configurations browser allows the user to browse, add, and remove Audit Configurations as well as select Audit Configurations for editing (see Figure 1 Audit Configurations browser).

Figure 1 Audit Configurations browser

An Audit Configuration can only be removed if no events were recorded by this configuration.


4 Audit Configuration PropertiesThe Audit Configuration properties screen is displayed when the user chooses to add a new Audit Configuration or selects an existing one from the browser (see Figure 1 Audit Configurations browser). The properties of the Audit Configuration are divided into several tabs that will be discussed in the following sections.

4.1 Header TabThe Header tab (see Figure 2 Header tab) contains the general properties of an Audit Configuration. The following items can be defined:

Name – the name of the Audit ConfigurationDescription – the description of the Audit ConfigurationStatus – the Audit Configuration can be enabled or disabled, and the status can be changed using the Enable/Disable button on the right side of the screen

Figure 2 Header tab

4.2 Roles TabThe Roles tab (see Figure 3 Roles tab) defines the roles of the employees for which the Audit Trail will be generated. If there are no roles configured, then the Audit Trail will be generated for all employees.

For example, an employee with the employee number of 997xy is assigned the Production User and Warehouse User roles. There is an Audit Configuration defined to track changes in the ATTENDANCE table. Employee 997xy clocks in and out. The behavior will be the following:

If there are no roles configured, the Audit Trail will be created (for all employees)If there is a Process Author role configured, the Audit Trail will not be created (because employee 997xy has not been assigned this role)If there are Production User and Process Author roles configured, the Audit Trail will be created (because employee 997xy has been assigned one of these configured roles)


Figure 3 Roles tab

4.3 Audited Tables TabThe Audited Tables tab defines the tables that will be used to build an Audit Entity.

Figure 4 Audited Tables tab

4.3.1 Main Table

For each Audit Configuration, a Main Table must be selected. Only the Main Table is monitored for changes.

The Main Table selected for this scenario is ATTENDANCE.


4.3.2 Additional Tables

Additional Tables can be used to feed the Audit Entity additional reference data (e.g., the number of an employee taken from the EMPLOYEE table). The Audit Configuration can have multiple Additional Tables, but they are not required.

For example, an administrator wants to track changes in the attendance records. The ATTENDANCE table contains the EmployeeID column, which specifies an employee’s unique ID and which is linked to the EMPLOYEE table. However, it would be more useful for the end-user to see the employee number that is stored in the EmployeeNo column of the EMPLOYEE table, so the administrator adds the EMPLOYEE table as an Additional Table.

To add an Additional Table, click (Add). This will bring you to the Additional Table properties screen, which can also be accessed by clicking (Properties) after highlighting an existing Additional Table.

The Additional Table properties screen has two tabs (seeFigure 5 Additional Table properties screen – Header tab) – Header and Additional Table Properties – and allows the user to configure and edit the properties of an Additional Table.

For the purposes of this scenario, the following Additional Tables have been added:

Table Alias RequiredEMPLOYEE EMPLOYEEE ü

WORK_CENTER WORK_CENTER EMPLOYEE EMPLOYEE_CREATEDBY

Header Tab

On this tab, the following items can be defined:

Name – the name of the Additional Table, which must be linked by clicking (Link)Required – this check-box indicates if data from the Additional Table is required when building an Audit Entity

If the Additional Table is marked as Required, then during runtime the Audit Trail will not persist an Audit Event if data does not exist in the Additional Table

Alias – the alias of the Additional Table, which needs to be unique within the scope of the Audit ConfigurationDescription – the description of the Additional Table


Figure 5 Additional Table properties screen – Header tab

Additional Table Properties Tab

This tab defines the links between the tables (which is very similar to the concept of “joins” in the world of SQL). A link is based on an Audited Field (see 4.4 Audited Fields Tab) and describes which value of a field from the parent table will be used to retrieve a record from the Additional Table.

To add a link, click (Add), and select a Field Name and Parent Field Name.

Figure 6 Additional Table properties screen – Additional Table Properties tab

It is also possible to define the link between an Additional Table and parent table based on a constant value (as with the Facility Field Name in the table below). The value of a field in the Additional Table is filtered using the constant value specified in the grid.

For this scenario, the fields in the table below have been configured in the Additional Table Properties tab.

Additional Table Field Name Parent Field name Constant ValueEMPLOYEE EmployeeID AttendanceEmployeeID WORK_CENTER WorkCenter AttendanceWorkCenter

Facility Constant C1P1EMPLOYEE CreatedByEmployee AttendanceCreatedBy


4.4 Audited Fields Tab

4.4.1 Audited Fields

The Audited Fields tab defines the fields that comprise the Audit Entity. All Audit Trail features are built around Audited Fields. Audited Fields are used to define triggering criteria, filtering conditions, and links between Audited Tables so that they can be persisted in the Audit Trail.

This section allows the user to add, edit, and remove fields. The properties of Audited Fields are discussed further in the document.

It is important to note that the Audit Configuration must have a set of unique fields defined. A set of unique fields constitutes the "primary key" of the Audit Entity. During runtime, Audit Trail uses the unique fields to differentiate between two objects instantiated using the same Audit Configuration. If the unique fields are not defined, it is possible that changes to two different objects (e.g., two EMPLOYEE records) will be recognized as one change, and the data will be mixed (which is clearly undesirable).

In continuation of the previous example, the administrator wants to display employee numbers in the Audit Trail. To do this, the administrator can add an audited field that is mapped to the EmployeeNo column in the EMPLOYEE table.

4.4.2 Audited Field Properties

The Audited Field Properties screen appears after an Audited Field has been added, or it can be accessed by clicking (Properties) after highlighting an existing Audited Field. The screen (see Figure 7 Audited Fields tab – Audited Field Properties screen) allows the user to edit the properties of the Audited Field.

The following items can be defined:

Name – the name of the Audited FieldDescription – the description of the Audited FieldTable Alias – the alias of the table that contains the column to which the field is mapped

This table must already be in the collection of Audited Tables (see 4.3 Audited Tables Tab)

Table Field – the database column to which the field is mappedChange Triggers Audit – indicates if a change of value should trigger the creation of the Audit Trail

Please note that this option is available only for the fields that come from the Main TablePersisted in Audit Trail – indicates if a value of the field should be persisted in the Audit Trail

Please note that the fields do not necessarily have to be persisted in the Audit Trail, as they can be used for other purposes also (e.g., to link other tables or define conditions for other tables)

Unique – indicates if a field is part of the unique key that, during runtime, allows the Audit Trail to differentiate between objects instantiated from the same Audit Configuration


Figure 7 Audited Fields tab – Audited Field Properties screen

For our scenario, we have added the Audited Fields in the image below:

Field Name Table Alias Table Field Triggers Audit

Persisted Unique

AttendanceCreatedby ATTENDANCE CreatedBy ü

AttendanceEmployeeID ATTENDANCE EmployeeID ü

AttendanceEndTime ATTENDANCE EndTime ü ü AttendanceID ATTENDANCE ID ü AttendanceStartTime ATTENDANCE StartTime ü ü AttendanceWorkCenter ATTENDANCE WorkCenter ü

EmployeeID EMPLOYEE ID ü EmployeeName EMPLOYEE Name EmployeeNo EMLPOYEE EmployeeNo ü CreatedBy EMPLOYEE_

CREATEDBYName ü

CreatedByEmployee EMPLOYEE_CREATEDBY

EmployeeNo ü

WORK_CENTER WorkCenter ü

Faclilty WORK_CENTER Facility ü WorkCenter WORK_CENTER WorkCenter ü ü

4.5 Audit Conditions TabThe Audit Conditions tab (see Figure 8 Audit Conditions tab) defines conditions that will be evaluated to determine if an Audit Entity should be persisted in the Audit Trail. The conditions can be established for all Audited Fields and for all available standard DELMIA Apriso operators.

Additionally, a database action can be defined on which the Audit Entity will be persisted.


For example, an administrator wants to create an Audit Trail that will consist of all additions and all edits performed by users. Additionally, the administrator wants to exclude two users from the Audit Trail: ADMIN and SYSTEM.

To configure these conditions, the administrator:

1. Unselects the Delete checkbox in order to indicate that the Audit Trail shall not be persisted when the user deletes data from the database.

2. Adds the following Advanced Filter: EmployeeNo NOT IN Admin,System (see Figure 8 Audit Conditions tab).

This means that the value of the EmployeeNo field should not be in the ADMIN or SYSTEM sets of values

Figure 8 Audit Conditions tab

4.6 Key Values TabDuring runtime, Audit Trail keeps all the values of the Audited Fields as serialized properties of the Audit Event. The Key Values tab (see Figure 9 Key Values tab) defines – as Audited Fields – which values will be stored in regular columns. The fields defined as Key Values can be used in search conditions both in DELMIA Apriso and in custom SQL queries.

For example, an administrator defines an Audit Configuration on the ATTENDANCE and EMPLOYEE tables and sets EmployeeID as Key Value 1. The users of the Audit Trail request to be able to search the Audit Events by EmployeeNo and AttendanceEndTime, which are both fields of the Audit Configuration. The administrator defines that Key Value 2 will contain the value of the EmployeeNo field, while Key Value 3 will contain the value of the AttendanceEndTime field.


Figure 9 Key Values tab

4.7 Common Configuration MistakesDefining Audit Configurations and designing Audit Trails may require deep functional and technical knowledge of DELMIA Apriso data models. Invalid configuration can dramatically destabilize the system, and, though it may not affect (i.e., modify) DELMIA Apriso data, it may lead the system to an unexpected stop.

These are some common mistakes made when configuring Audit Trail and their resolutions:

The application was not restarted after the Central Configuration had been changedChanges in the Central Configuration require the application to be restarted for the changes to take effect (see 2.4 Central Configuration)This concerns both the ASP.NET runtime engine and DELMIA Apriso services

The link between tables is not defined properlyTables cannot be linked to invalid columns (e.g., the EmployeeID column in the EMPLOYEE table cannot be mapped to AttendanceStatus) (see 4.3 Audited Tables Tab)An error message (with this icon: ) will appear for any incorrect links on the Additional Table Properties tab of the Additional Table properties screen

The fields are mapped to the wrong columnsA field cannot have a name that suggests a different mapping than actually exists (e.g., the EmployeeNo field cannot be mapped to the GivenName column) (see 4.4 Audited Fields Tab)

The unique fields have not been definedThe Audit Configuration must have fields that are unique and they need to be marked as such (see 4.4 Audited Fields Tab)


5 Audit Trail UsageThe Audit Configurations browser (see Figure 10 Audit Configurations browser) allows the user to select the Audit Configuration for which the Audit Trail should be presented. To do this, select the desired Audit Configuration and press (Audit Trail).

Figure 10 Audit Configurations browser

The Audit Trail main screen consists of two sections (see Figure 11 Audit Trail main screen):

1. The Audit Trail section is a standard DELMIA Apriso grid that presents Audit Events persisted for the selected Audit Configuration. The list of Audit Events can be filtered and sorted by Action, Employee, Date, and various Key Values.

2. When a specific Audit Event is selected, the Audit Event Details list is filled with the values of all of the fields that are defined in the selected Audit Configuration.

Figure 11 Audit Trail main screen

For detailed information on enabling and using (Signature) in Audit Trail, refer to the 21 CFR Part 11 Compliance Implementation Guide.


All the internal documents referenced in this section are available from the DELMIA AprisoStart page, which can be accessed on your DELMIA Apriso server (<server name>/apriso/start).The newest versions of all documents are available from 3DS Support at:http://www.3ds.com/support/documentation/overview/

6 ReferencesInternal Documentation

1. 21 CFR Part 11 Compliance Implementation Guide

Describes how the FDA's 21 Code of Federal Regulations (21 CFR Part 11) on Electronic Records/Electronic Signatures are incorporated in the DELMIA Apriso solution. The guide also describes what modules are enhanced with the Electronic Signature-related functionality and how DELMIA Apriso (as a set of those modules) should be configured to support it.

2. Central Configuration Documentation

Describes in detail all the keys of the Central Configuration (CC) file for DELMIA Apriso. Various sections group the keys for individual modules or distinct functional areas.

3. Database Documentation

Enables viewing DELMIA Apriso database (DB) tables (organized into groups), their descriptions, and the relations between them.

3DS Support Knowledge Base

If you have any additional questions or doubts not addressed in our documentation, feel free to visit the 3DS Support Knowledge Base at https://www.3ds.com/support/knowledge-base/.


http://www.3ds.com/support/

https://www.3ds.com/support/knowledge-base/

audittrail - microsoft azurejpabapriso02.japaneast.cloudapp.azure.com/apriso/... · 2018. 8....

Documents