Skip to Content
avatar image
Former Member

Will FireFighter send a report to the Controller if no activity was done?

We have our FF system set up to send out a log report each night to the Controllers. If someone logs into their FFID and then immediately exits back out without doing anything, will the nightly email job (pgm /virsa/zvfat_log_report) report this FF session?

We are on GRC 5.3 SP13.

Thanks.

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

1 Answer

  • avatar image
    Former Member
    Aug 03, 2011 at 05:13 AM

    Hi Bob,

    Firefighter will have 3 types of logs:

    1. Session

    2. Transaction

    3. Change data.

    The answer for your question is a big Yes.

    The FF session (Login/Logout) report will be still sent even though user hasn't performed any thing. However, if user executes any transactions, it will be captured by the transaction log.

    Change data is when any changes made to the configuration.

    Hope this clarifies.

    Regards,

    Raghu

    Add comment
    10|10000 characters needed characters exceeded

    • Bob,

      You are correct. The log will only generate for actual activities performed. If nothing was done, then nothing will be reported.

      I did encounter an example of this whereby an auditor requested positive evidence where the FFID was assigned but never used.

      The client ended up trawling through SUIM and the audit event logs to prove the lack of FFID logon before finally convincing the auditor to accept the completeness of the SPM Log for any positive actions performed. They took the view that if they logged in without performing anything, then a risk was never actually realised anyway.

      Simon