Audit logs
YTCC answers "who did what, when" from four records. Each covers a different kind of action; together they cover sign-ins, user administration, configuration changes, operator actions and commands.
| Record | Records | Kept | Read by |
|---|---|---|---|
| User audit log | Sign-ins, sign-outs, failed sign-ins, password changes, users and profiles created, changed and deleted, policy changes, four-eyes approvals, interlock overrides, color and AI access changes | A file in the data folder; when it reaches 5 MB it is replaced, keeping one older file (about 10 MB in total) | Root |
| Configuration audit | Every applied change of the configuration: who, when, from where (grid, form, import, AI …), the comment, and every changed record with its old and new values | The project database, for the life of the project | Every signed-in user of the project |
| Event list | Operator actions (pages and popups opened, sign-in and sign-out, confirmations, area control, operating mode, communication control, interlock overrides, switching programs, tags and notes), alarms, commands, system events and signal changes | The history database, 1825 days by default | Every signed-in user of the project |
| Command log | Every command: time, signal, value requested and sent, user (or script:<name>), result, reason, read-back value, and for overrides the reason and the approver | The alarm archive, two years | Users who can reach the server over the network |
Every entry carries the user as checked by the server, never a name sent by the browser, and for sign-ins and operator actions the client address.
The server account has a user audit log of its own, the file _srv.jsonl in the audit folder of the projects
server's data folder. Besides its sign-ins, it records the server operations of the home page: every project backup
(project_backup, with the project, the file, its size and whether it is a sample package), every download of a backup
(project_backup_download), and every import of a project package, once when it starts and once with its result
(project_import), and every schema upgrade of a project with its result (project_upgrade). Each entry has the account and the client address. A full backup contains the password hashes of the
users, which is why downloads are recorded too. See Backup and restore.
Protecting the records
- The records are ordinary files and database tables. Protect the server and its data folder, and restrict network access to the YTCC server so that only the operator stations reach it.
- The event list and the command log export to Excel.
- The user audit log keeps about 10 MB. Keep a regular copy of the file if you need a longer record.
- A locked account shows as failed sign-ins in the user audit log.
How to open and filter them: Review audit logs. How this relates to the requirements of IEC 62443-3-3: Security model and IEC 62443-3-3.