VSOM Archive names changed

[spencer6321]

We recently had a request to look at a video archive of an incident that occurred three days ago.  I went into the archives to pull out the requested time frame and got a nasty surprise.  Almost all of my archives had switched from a thirty day rotation to a 24 hour rotation.  Also most of the names had changed to "regular" xxx.  I know that my thirty day rotation was working for over a year and some still all.  Any suggestions on what may have caused this change or how to track down when it happened?

Thanks

Spencer

[Holly Goguen]

Hi Spencer,

As I'm sure you can imagine, archive length cannot change automatically.

In fact, the only thing that you can change on an archive without stopping current and creating new, is the expiration date (not the loop time)

So it sounds like they were all manually changed to a 1-day loop

The fact that the names got changed to regular XXX leads me to believe that the archives (the new 1 day loops) were created via batch admin. 

It's possible to run some reports in VSOM to see who logged in and made changes.

Do you have multiple users configured on the system ? Or does everyone log in as "root" ?

~Holly

[spencer6321]

Holly,

There are only two users that have "root" privileges.  Are the reports you mentioned standard (predefined) or custom?  I believe someone used my userid to do what you've suggested.  I'm just trying to narrow the time frame.

Thanks

Spencer

[Holly Goguen]

Hi Spencer,

They are standard reports in VSOM:

VSOM -> Admin -> Reports (under system heading)

Check out the User Activity Report there.

You can search by range of date/time.

You can choose to include the root user, or leave that unchecked and it will search only on additional users in the system (who may or may not have root priveileges.

~Holly