+12Greetings,
Is there a way to determine the last time a policy was triggered? I’m doing some clean-up in my cloud environment, and have several policies created by other people that I’m reasonably certain haven’t been used in a long while; like months or years. Ultimately its my decision on whether to remove the policy or not, but having evidence to support that decision (and the knowledge of how to get that evidence anytime) is useful to me.
Best answer by Chubs
Well then I’d say it’s safe to disable it and see if anyone screams….then after 30 days *clicks delete*
+22I usually click the policy, click logs, and then sort by date to get an idea.
+12I should clarify that I know I can view policy logs to see this, however not all of the policies have logs, which one might think means the policy never ran, but if I’m not mistaken, if a device record is deleted, the policy logs for that device are also deleted, which means a policy could have run, then at some point later the logs for the policy were flushed when the device was deleted, so there is no record of the policy running.
Im really hoping for a higher level view of when any/all policies were last used.
+24If you check the logs, you can sort by last time it ran and that’s the date/time you want?
If the policy doesn’t have a log, then it didn’t “run” or “run correctly” on devices and should be investigated.
+12Sort of, but if the device was deleted, so goes the policy log. We have a *bunch* of policies with no log entries, so no idea when they were last run, if ever.
+24Well then I’d say it’s safe to disable it and see if anyone screams….then after 30 days *clicks delete*
+12That was pretty much my plan. Was just looking for data to prove my point to anyone who starts screaming./. The policy logs (or lack thereof) will have to do.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.