Change Tracking - The Log

[LEFT][CODE]https://blogs.technet.com/isablog/archive/2008/07/12/change-tracking-the-log.aspx[/CODE]

I'm often asked "Where is the Change Tracking log stored?" The answer is simple:
[INDENT] [B]The Change Tracking log is stored alongside the ISA configuration it documents.[/B][/INDENT]The ISA configuration is stored in the local registry (Standard Edition) or in the CSS (Enterprise Edition). The Change Tracking log is stored in there too, as a VPS (Vendor Parameter Set). In Standard Edition, there is only one log. In Enterprise Edition, there can be several:
• One log for each array
• One log for the whole enterprise
• One log for each enterprise policy.
Every change is noted only in the log it's relevant in*.

When you look in the Change Tracking tab of the ISA Management monitoring node, you see a combination of:
• The log for the current array
• The enterprise log
• The log for the enterprise policy assigned to the array.
You can tell which entry comes from where by looking at the "Array" column:
[IMG]http://blogs.technet.com/photos/isablog/images/3087802/original.aspx[/IMG]
Note that if you make one change in, say, both array and enterprise, then it will be split into 2 entries, each documenting the relevant part and stored in the relevant log:
[IMG]http://blogs.technet.com/photos/isablog/images/3087803/original.aspx[/IMG]
Now you know why, if you create a new array, you don't see it in Change Tracking: You need to look in the Change Tracking tab of that new array. Same with a new enterprise policy: You can only see it if you look in the Change Tracking tab of an array which is assigned to the new policy. For fun**, you can change the policy assignment of an array, not even bother to apply, and look at the Change Tracking tab - it will show the new policy log!
Unfortunately, ISA Enterprise Edition doesn't have built-in enterprise monitoring, so you can't see the change logs of all arrays/etc on one screen. But no fear: In a future post, I will show a sample of an enterprise change log viewer. Stay tuned…

[SIZE=-3]* There's one exception: If you delete an array or an enterprise policy, this deletion will be marked in the one enterprise log. This is because the array's/policy's change log is deleted with the array/policy itself, and we want to leave at least some hint about what happened.
** Or at least, certain people's definition of fun.
[/SIZE]

-Jonathan Barner, ISA Sustained Engineering Team



[/LEFT]