Change Tracking - The Log

I'm often asked "Where is the Change Tracking log stored?" The answer is simple:

The Change Tracking log is stored alongside the ISA configuration it documents.

The ISA configuration is stored in the local registry (Standard Edition) or in the CSS (Enterprise Edition). The Change Tracking log is stored in there too, as a VPS (Vendor Parameter Set). In Standard Edition, there is only one log. In Enterprise Edition, there can be several:
• One log for each array
• One log for the whole enterprise
• One log for each enterprise policy.
Every change is noted only in the log it's relevant in*.

 

When you look in the Change Tracking tab of the ISA Management monitoring node, you see a combination of:
• The log for the current array
• The enterprise log
• The log for the enterprise policy assigned to the array.

You can tell which entry comes from where by looking at the "Array" column:

 

Note that if you make one change in, say, both array and enterprise, then it will be split into 2 entries, each documenting the relevant part and stored in the relevant log:

Change tracking split entry 

Now you know why, if you create a new array, you don't see it in Change Tracking: You need to look in the Change Tracking tab of that new array. Same with a new enterprise policy: You can only see it if you look in the Change Tracking tab of an array which is assigned to the new policy. For fun**, you can change the policy assignment of an array, not even bother to apply, and look at the Change Tracking tab - it will show the new policy log!

Unfortunately, ISA Enterprise Edition doesn't have built-in enterprise monitoring, so you can't see the change logs of all arrays/etc on one screen. But no fear: In a future post, I will show a sample of an enterprise change log viewer. Stay tuned…

 

* There's one exception: If you delete an array or an enterprise policy, this deletion will be marked in the one enterprise log. This is because the array's/policy's change log is deleted with the array/policy itself, and we want to leave at least some hint about what happened.
** Or at least, certain people's definition of fun.

 

-Jonathan Barner, ISA Sustained Engineering Team