Ability to track/ audit GroupWise Administrative Changes - System Wide - with Sentinel or other event management tools

[LeandraS]

GroupWise has no ability to track/ audit GroupWise Administrative Changes - System Wide - with Sentinel or other event management tools. This is a real urgent requirement.

[ghoman]

Yes. Who did what when from where (IP address of admin browser session)

[David Gerisch]

I particularly need to be able to see if a message retention flag was un-set on a mailbox (for example).

[AndyK3]

Even without directing them to a SIEM solution, we need a way to have the GW-Admin console log who logged in and from where. To be able to track who made the changes that are logged in /var/log/novell/groupwise/gwadmin/gwadmin-console.log ? Usually only failed logins show in that file, and are a bit cryptic a non-admin with correct credentials has the same report as a non-admin without correct password. 2016-11-15 13:11:50 GwAuthenticationProvider [ERROR] ***Failed to Login **** No admin rights bogus IDs that don't exist in the system only show as failed login 2016-11-15 13:12:03 GwAuthenticationProvider [ERROR] ***Failed to Login **** Not allowed At least the user names of failed/blocked logins are shown in gwadmin- service.log, but we still can't tell who did what.

[David Gerisch]

Reiterating this request: apparently, I have a help desk person un-setting the message retention flag on some mailboxes (which could get us in a boatload of legal trouble), but I cannot tell who is doing this. If I knew who was doing this, I could tell them to stop (or take away their administration rights).

[davidkrotil]

This is totally needed, everything is now audited, why not GroupWise ( more secure as Exchange )

[andredaguerre]

Yes, It's a need.........

[tholliday]

Please add this auditing features