Trigger for Taking Snapshots

6-8 Oracle Fusion Middleware Users Guide for Oracle Identity Manager – Resource status change – Addition of provisioning tasks to the provisioning process – Updates to provisioning tasks in the provisioning process, for example, status changes, escalations, and so on – Creation of or updates to Process Form data

6.3.2 Post-Processor Used for User Profile Auditing

The user profile auditor has an internal post-processor that normalizes the snapshot XML into the reporting tables: UPA_USR, UPA_FIELDS, UPA_GRP_MEMBERSHIP, UPA_RESOURCE, UPA_UD_FORMS, and UPA_UD_FORMFIELDS. These tables are used by the reporting module to generate the appropriate reports.

6.3.3 Tables Used for User Profile Auditing

Table 6–5 lists the tables in the database that User profile audits use: Note: For more information about the User Profile Audits tables, such as column names and how to use them, refer to the schema documentation provided with Oracle Identity Manager. Table 6–5 User Profile Audit Tables Table Name Description AUD Stores detailed information about all of the Auditors for example, the User Profile Auditor supported by Oracle Identity Manager. Currently, only the UserProfileAudit entry is available. AUD_JMS Staging table that stores information about changes made as a part of any business transaction. This is an intermediate table to temporarily store data changelog data before the audit engine consumes it. When Audit messages are successfully processed, corresponding records are deleted from the table. Note: This table is not intended for end users and must not be used directly. UPA Main auditing table for storing all snapshots and changes made to the user profiles. UPA_FIELDS Stores user profile audit history changes in denormalized vertical format. UPA_GRP_MEMBERSHIP Stores groups membership history in denormalized format. UPA_RESOURCE Stores user profile resource history in denormalized format. UPA_USR Stores user profile history in denormalized format. UPA_UD_FORMS Together with the UPA_UD_FORMFIELDS table, contains information about changes to the users account profile process form. This table keeps track of the changes to the various forms, such as parent or child forms, which are being changed in any transaction. The changes to the account or entitlement attributes are stored in the UPA_UD_FORMFIELDS table. UPA_UD_FORMFIELDS Stores the names of account or entitlement profile fields that are modified. This table also keeps track of the old and new values of the modified fields. Auditing 6-9

6.3.4 Archival

User Profile audit data growth is based on the setting of the audit levels, and the growth can be significant in most of the deployments. There is also a requirement to clean or archive the old user profile audit data to accommodate future growth. You can use Audit Archival and Purge Utility to meet these requirements. See Using the Audit Archival and Purge Utility in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for detailed information about this utility.

6.4 Role Profile Auditing

Role profile audits cover changes to role profile attributes, role administrators, and direct subroles. This section discusses the following topic: ■ Data Collected for Audits

6.4.1 Data Collected for Audits

Unlike user auditing, an independent audit level is not defined for role profile auditing. Instead, the audit levels defined for user profile auditing are used for role profile auditing. Role profile auditing takes place only if the audit level defined for user profile audit level is Membership or a level higher than that. By default, user profile auditing is enabled and the audit level is set to Resource Form when you install Oracle Identity Manager. As a result, role profile auditing is also enabled by default because the default audit level for user profile audit is Resource Form, which is higher than Membership. This section discusses the following topics: ■ Capture and Archiving of Role Profile Audit Data ■ Storage of Snapshots ■ Trigger for Taking Snapshots

6.4.1.1 Capture and Archiving of Role Profile Audit Data

Each time a role profile changes, Oracle Identity Manager takes a snapshot of the role profile and stores the snapshot in an audit table in the database. Note: ■ The UPA_UD_FORMS and UPA_UD_FORMFIELDS tables together store the audit trail of changes to the users account profile in a de-normalized format. These tables can be used in various audit-related reports. ■ The UPA_UD_FORMS and UPA_UD_FORMFIELDS tables will be populated only if the XL.EnableExceptionReports system property is set to TRUE. For more information about this property, see System Properties in Oracle Identity Manager in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager.