Re: audit trail - would this work?

[Christopher Snow]

I'm interested in developing this.  It looks like a good project to  
help me to deepen my understanding of the ofbiz internals.

Cheers,
Chris


On 29 Mar 2007, at 20:04, David E. Jones wrote:


If I understand you right, this sort of thing has been discussed  
before, and wouldn't be terribly complicated to implement as an  
extension to the Entity Engine, but it can introduce a huge amount  
of overhead for the app server and database (if there are very many  
fields to do this with).

What you'd basically be doing is keeping a revision history of a  
set of fields across various entities. A few thoughts from past  
meanderings of the mind:

1. use generic data structures to keep track of general revision  
histories for fields; would probably need something to support all  
of the common different field types (could use a single less than  
255 character string, maybe some other simplifications)

2. do something to track together sets of fields that are changed  
at the same time, at least the fields in the same entity and  
perhaps even those across an entire transaction

3. do something to track who made the change (harder since the  
entity engine doesn't require user information to be passed down,  
and it's not always available), and when the change is made (pretty  
easy, we do it all the time already)

Once all of this is in place all you'd have to do is set some sort  
of track-revisions="true" attribute on each field definition you  
want tracked.

Is this something you are interested in developing, or sponsoring  
the development of?

-David


On Mar 29, 2007, at 12:54 PM, Christopher Snow wrote:

Would this work?

Add an optional element (or attribute) to entity field elements  
called audittrail.  The presence of the audittrail element tells  
the entity engine that you wish to record changes to the field in  
an audittrail table.

<entity ...>
  <field ...><audittrail/></field>
  ...
</entity>

Separate entities could be created representing each field type,  
so the entity engine could record the changes to the field in a  
field of the same type:

<entity name="auditIdNe" ...>
  <field name="beforeValue" type="id-ne".../>
  <field name="afterValue type="id-ne" .../>
</entity>
<entity name="auditIdVlong" ...>
  <field name="beforeValue" type="id-vlong".../>
  <field name="afterValue type="id-vlong" .../>
</entity>
<entity name=...  repeat for all the data types

Any ideas/feedback?

Thanks in advance ...


On 29 Mar 2007, at 09:29, Christopher Snow wrote:

No response - have I said something wrong?  I would really  
appreciate
some direction on an approach to keeping audit trails ...

Thanks in advance.

Chris

On Tue, 2007-03-27 at 05:10 +0100, Christopher Snow wrote:
On Mon, 2007-03-26 at 21:49 -0600, David E. Jones wrote:
On Mar 26, 2007, at 9:26 PM, Christopher Snow wrote:

Does anyone using ofbiz keep audit trails?

Audit trails of what? Keep in mind the requirements vary from data
element to data element... so which of the hundreds of top  
level data
structures (or more detail if you'd like) do you have in mind?

The requirements for audit trails are specific to each business   
(except
financial transactions where audit trail requirements are  
stipulated by
law, accounting stds, etc).

CA Clarity allows the system administrator to configure audit  
trails to
meet the business requirements by allowing the admin to simply  
choose
which entity attributes should be logged.  The application takes  
care of
the logging and provides screens to view the audit log.

My specific need is to to implement some form of audit trail in  
a risk
management application I'm developing.  What I was hoping for is  
some
kind of ofbiz pattern to point me in the right direction.

Is ofbiz used in SOX environments?

Good question... I know there are various publicly traded  
companies
that use OFBiz, but I don't think any of them are using it for
accounting and such. Still for the accounting and general  
framework
level stuff in OFBiz, I would suspect that it should comply quite
well with Sarbanes Oxley. Of course, those laws may be repealed  
and/
or replaced by the time a real review is done by a publicly traded
company that needs to AND all changes required go back into  
OFBiz...

Are you saying that you are doing an accounting, inventory
management, etc implementation of OFBiz for a publicly traded  
company
and need to do a SOX audit? If so I'd guess you have a fair budget
for it, so I can't wait to see more!

The reason for mentioning SOX is because it is the main driver of
customer requirements for audit trails when configuring CA  
Clarity for
the customer.


Is this the only way?:

The only way to... ?

Is the process below (email from Anil to you) the recommended  
way for
implementing audit trails?


-David


Anil,

You could do this there, that should work fine. I wouldn't use a
toString()
and equals() for comparison, I would just use the equals()  
method
on the
classes. For general knowledge you should check out the  
Comparable
interface
which is used for finding out =, !=, >, >=, <, <=, etc.

Later,
-David Jones

-----Original Message-----
From: Anil K Patel [mailto:toanilpatel at hotmail.com]
Sent: Thursday, October 10, 2002 1:13 AM
To: jonesde at ofbiz.org
Cc: ofbiz-entity-dev at lists.sourceforge.net
Subject: Re: [OFBiz-Entity-Dev] Keep Audit trail of Change of  
Data in
Tables


David,
What if I modify the "set(String name, Object value, boolean
setIfNull)"
in GenericEntity class such that It compares the new value to  
the
Old value,
changes the fieds map only if required. If at all you think this
is OK to
do, Then I need  help in Logic to compare the values of field.
Will calling ToString on values and then comparing be OK?
Regards
Anil




---- Original Message -----
From: "David E. Jones" <jonesde at ofbiz.org>
To: "Anil K Patel" <anilpatel72 at netscape.net>;
<ofbiz-entity-dev at lists.sourceforge.net>
Sent: Wednesday, October 09, 2002 11:35 PM
Subject: RE: [OFBiz-Entity-Dev] Keep Audit trail of Change of  
Data
in Tables



Anil,

There is nothing in the Entity Engine to do this automatically,
but I
suppose it could be done. You mean you want to log EVERY change
of EVERY
field? That could be a lot of data. There are many  
variations on
this that
have varying impacts, it really depends on how little you  
can get
away
with.

If you get the most recent stuff from CVS there is an original
values map
that is needed for full auto cache clearing and can be  
useful for
this
type
of application as well.

Later,
-David Jones




-----Original Message-----
From: ofbiz-entity-dev-admin at lists.sourceforge.net
[mailto:ofbiz-entity-dev-admin at lists.sourceforge.net]On  
Behalf
Of Anil K
Patel
Sent: Thursday, October 10, 2002 12:03 AM
To: ofbiz-entity-dev at lists.sourceforge.net
Cc: jonesde at ofbiz.org
Subject: [OFBiz-Entity-Dev] Keep Audit trail of Change of  
Data in
Tables


I am using Entity Engine.
Major Issue
I have a requirement to keep Audit of Change of Data in Tables
(columns).
If
somebody has experiance doing something similar or has Idea on
how we can
do
it.

Sub Issue
On an existing Entity If I run findByPrimeryKey and get the
GenericValue
object, now If I set a propertyname/value map or Loop  
through all
the
attributes and set value for each property in a GenericValue
Object. Is
there a way for me to know if the new value set for a  
property was
different
then Old value for the property.

Regards
Anil K Patel

On Mon, 2007-03-26 at 16:09 +0100, Christopher Snow wrote:
Is there a preferred way of setting up an audit trail of  
changes to
entity data in ofbiz?

Thanks in advance ...








--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.




--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.