We are being audited and we are looking for a way to find out if a particular user accessed the system in a specific time frame.
The options are:
The audit log keeps a history of all *unsuccessful* login attempts:
Will only show failed login attempts:
TO_CHAR(EVENTTIME, 'mm/dd/yyyy hh:mi:ss') EVENTTIME,
WHERE ACTIONOBJID = 411;
In the database, the HARUSER table records the last time the user successfully logged in to the system. But this will not show a history of every login attempts by a specific user.
Will show the last successful login of each user:
TO_CHAR(HARUSER.LASTLOGIN, 'mm/dd/yyyy hh:mi:ss') LASTLOGIN;
If the HBroker logs exist for the desired time frame , the other option would be to search the broker log files (<date>HBroker<pid>.log) for entries like this:
- Default: On User register - 10:48:10
From : /pt_HClient://scm-broker/2492
User : harvest
Any attempt to login will have an entry like this in the broker log files.
If you're looking for a specific type of activity, the audit logs record certain things like create/update project, state, user, packate, etc.
We can also search the various main tables for any records last updated by the desired user. All the main tables like HARPACKAGE, HARENVIRONMENT, HARSTATE, HARVERSION, etc have these fields:
But, again, it only shows the last update, not a history of all updates.