How can we find out from Audit log that Copy Configuration was done?

[shubhraneel]

Hi,

Product: SAP Customer Data Cloud.

If someone did a 'Copy Configuration' from a source site to a target site then how can we find it from the Audit log? Or What search query we need to enter in audit log?

[olehi941]

Hi Shubhraneel,

The Copy Configuration tool triggers SAP CDC APIs to move changes from the source to the target site.
This means that CDC doesn't have a specific ONE separate API for doing this.

When in Copy Configuration tool you select:
Schema -> It triggers accounts.setSchema
Screen Sets -> It triggers accounts.setScreenSet
Policies -> It triggers accounts.setPolicies

Q: "If someone did a 'Copy Configuration' from a source site to a target site then how can we find it from the Audit log? Or What search query we need to enter in audit log?"

A: I see the next options you can use:
1) Use OOTB Audit Log UI tool or use Postman with audit.search REST API
2) Use Dataflows

The first option I would use to check something and sometimes manually.
This query could help you to find specific APIs in specific time range

 SELECT * FROM auditLog WHERE (@timestamp > '2023-03-21T23:47:00.000Z' AND @timestamp < '2023-03-21T23:48:00.000Z') AND (endpoint = 'accounts.setScreenSet' OR endpoint = 'accounts.setSchema' OR endpoint = 'accounts.setPolicies')

The second option(using Dataflows) could help you to automate the process. You could create a scheduled Dataflow, which reads data from Audit(datasource.read.gigya.audit) with some pretty similar conditions as in query.
In response from accounts.setSchema and accounts.setScreenSet you can find userKey which gives you the capability to identify who did these changes. The result(file) you can send to ftp/sftp or to some cloud apps, like s3, azure blob, googlecloud..or to some external resource to create reports.

Hope it helped you or gave a direction to deep dive into this.

[SebastianSchuck]

Props for this very detailed response 😄