Transcript Whodunnit? A Hyperion Murder Mystery Casey Ratliff, System Architect Jon Harvey, EPM Practice Lead HUGMN TechDay 03/19/14

Whodunnit?
A Hyperion Murder Mystery
Casey Ratliff, System Architect
Jon Harvey, EPM Practice Lead
HUGMN TechDay
03/19/14
eCapital Advisors Overview
Oracle/ Hyperion/ OBIEE
• Strategic assessments & technology roadmaps
• Project Managers with extensive implementation
experience
• Business consultants with planning, financial
reporting & consolidation delivery experience
• Certified Oracle Planning, Essbase, HFM, OBIEE
Consultants
• Customer enablement services (training, hosting,
extended support and managed services)
• Employee lead engagements with minimal
contractor utilization
• Board of Director Advisors to the MN Hyperion
User Group
eCapital Advisors Overview
Founded in 2001 – Profitable every year in business
Performance management consulting firm
Over 250 performance management customers
eCapital Advisors employees:
• Dedicated to Enterprise Performance Management
and Business Analytics, helping client better
understand business drivers
• Proven record and high customer satisfaction
• Experience across a variety of industries and have
worked with companies of all sizes
2013 Inc. Magazine
Inc. 5000 award: #1558
2013 MSP Business Journal
Fast50 award winner, #17
eCapital Oracle BI & Hyperion Client Sampling
Agenda
Well, “agenda” ruins the fun of it…
Key points we’re going to cover
•
•
•
•
6
Who changed the system?
Who changed data?
Who changed the application objects?
New functionality in 11.1.2.3
Why audit?
Why are systems audits important?
• Mandated by data set
• Prevention of malicious acts
• Useful for troubleshooting
The perils of not auditing?
Our story begins…
Our story begins…
We know that our nightly batch completed successfully at 10PM
Batch runs metadata updates, redeployment and calc scripts
Our first suspect…
Was it:
Who:
Col. Mustard
Where:
Server console
Weapon: The EPM Configurator
Windows Event Viewer
 Security log failures
 System reboot
 Backup conflicts
EPM Deployment Report
 Architecture
 Configurations
 Changes to Registry
Digging in
While the IT department continues to troubleshoot…
The system is up and running fine now, but our tie outs are hosed
Who changed the data?
Data audit options available to us
• SSAUDIT
• Planning Data Audit
Let’s take a look at both…
SSAUDIT
• Essbase.cfg setting
• Tracks Essbase writes only
SSAUDIT
Generates 2 files
• Generates an ALG and ATX file
SSAUDIT
ALG File
• History records from every update transaction
• Includes user name, time stamp, and number of updated rows
SSAUDIT
ATX File
• Transaction records in a format that can be used as the input
source for data load
Planning Data Audit
11.1.2.0, 11.1.2.1 (Administration→Application→Reports)
11.1.2.2 (Tools→Reports)
Planning Data Audit
Planning Data Audit
When we look into our audit table…
Our next suspect
Who:
Nick Chihak
Where:
Planning App
Weapon: Data Form
The Plot Thickens…
Who would try to frame Nick???
Shared Services Audit Reports
What information is available to us in Shared Services?
Shared Services Audit Reports
The catch – not enabled by default
Looking back, the fake ID only changed one YearTotal dollar amount,
but our variances are much bigger.
Could calcs or other objects have been changed?
Now what?
We know the batch completed successfully, like it always does
The nightly batch does a bunch of stuff, including:
• Imports Metadata
• Redeploys the application
• Runs calc scripts
• Runs report scripts
Let’s take a look at what information is available to us about these
objects’ change histories…
Were Objects Modified? (Planning)
Were Objects Modified? (Planning)
Were Objects Modified? (Calc Manager)
No history of changes, but has user ID and date
Were Objects Modified? (Essbase)
No history, no user ID, only update date
Where do we look next?
One of the first places we should have looked, EAS:
Half of the Entity dimension is missing!
Were Objects Modified in EPMA?
We found our culprit!
The Culprit
It was:
Who:
Jim Farley
Where: Dimension Library
Weapon: Import Profile
11.1.2.3
Fun exercise, but could have been a lot easier in 11.1.2.3
New in Shared Services 11.1.2.3:
“Artifact Change Reports”
Artifact Change Reports
Artifact Change Reports
Q&A