IdM Audit Log

Question

Does Identity Manager keep a record of all events like adds/deletes/modifies to entries it manages?
Are all attributes and values added recorded?
Are all attributes and values (before and after modification) recorded on updates?
Are all delete entry events recorded?
If so, how would I extract this information out of IdM to a log FILE?
Also, about how much effort is involved in creating the desired audit log FILE.
(Potential) Customers of Identity manager here have asked, after being shown a quick demo of IdM where is the ability to get statistical info e.g. how many entries added in past 24 hours/week/month? how many email accounts were created in past 24 hours/week/month etc etc...
I/they see a screen audit report as an IdM task but it doesnt seem to be able to dump useful information to a file. A file can be manipulated to produce these statistics, a screen cannot. This file can also be used by other external systems of course.

Answer 1

I cannot agree more with Mr greenfan88:
Clients should have a HIGH expectation in a system such as IDM which relates to provisionning, meta-directory and workflow
The main reason beeing that business processes are the core driver of successfull projects. Technical things comes in second place. Thus processes need to be highly traceable and reports customizable
What I think of IDM Reports:
* Nearly half of the standard reports are administrative reports (ex: list the connectors status, list the admins...) => No business value
* Other reports are pure AuditLog reports that correspond to a grep on logs => Low business value
* There are as well resource risk reports that scan inactive accounts... => No business value
* One report type provide statistical information which is good
* Only one report consolidate information (<> from just an audilog grep listing)
All these reports have low business value:
1) the attributes are technical ones
2) the reports types are frozen
3) Consolidation is very low
4) Scoping/Security of reports is based on ORGANIZATIONS. Very limited
5) Inputing parameters such as a date range, people/account status (active/inactive), or departement perimeter is impossible or very difficult to achieve
What I think of IDM AUDITOR:
* Quite the same since lots of reports are administratove
* Auditor introduces the notion of COMPLIANCE rules. This is good BUT it should be extended to business attributes, time ranges, active/inactive status...
Except the COMPLIANCE addition, I don't see much interesting features from Auditor. It is still in V1 or beta ?
=> I hope the product line will improve to include REAL REPORTS like the ones we can make with BUSINESS OBJECTS or CRYSTAL REPORTS...
Rgds,