AnsweredAssumed Answered

Does closing watches provides more efficiency than closing CRs

Question asked by Maninder Bhamrah on Mar 24, 2020
Latest reply on Apr 6, 2020 by Mostafa Helmy

Like • Show 0 Likes0
Comment • 11

I have multiple open CRs which did not close out due to certain technical issues, but while we search for the root cause, we need to close the CRs. Should I proceed with the closure of CRs or check on closing the open watches as well. Kindly let me know what efficiency watches provide over closing CR, and whether closing of CRs will work prefectly.

Mostafa Helmy

Mar 26, 2020 6:30 AM

Correct Answer

Please do not proceed this way. Closing CRs using SQL queries is a very bad practice and will never clean-up all dependencies as the UI would do.

For example here are some things that the proper cancel button from the UI will handle:

Clean up any pending accounts created in the CR.
Handle dependant change items in other CRs (for example: Add Entitlement to Account in CR2, where the Account is being created in to-be-cancelled CR1).
Change the status of any associated violations (for example: Pending Revoke to Open).
Properly close underlying workflows inside the CR.
Clean-up any Role Versions related to the CR in case of BRM, so Roles do not stay stuck in the "Applied” status or internal relations getting mixed up.

I know that you may be using a SQL script provided by RSA support at one point, but any of such scripts are provided to be run for a specific case and are not to be used to generally close CRs.

Here are some alternatives:

Cancel CRs from the UI
1. Got to Requests > Requests.
2. Select all CRs you want to cancel.
3. Click the "Cancel Requests (n)” button to bulk cancel all selected Requests.
Use any scripting language you want to run the cancelChangeRequest web service iteratively against multiple CRs (example attached).
On the most recent patches, you can now bulk cancel specific change request items from the UI.
1. Go to Requests > Activities > By Pending Verification.
2. Select the change items you want to cancel.
3. Click the "Cancel (n)” button to bulk cancel all selected items.
4. Once all items in a specific Request are completed or cancelled, the request should automatically get completed.

See the reply in context

1 person had this question

Outcomes

Mostafa Helmy

Mar 24, 2020 10:08 AM

How do you intend to close a watch/CR?

Will you cancel the CR or will you actually modify the source data so that the changes get verified?

Actions

Maninder Bhamrah @ Mostafa Helmy on Mar 26, 2020 5:25 AM

Hi,

I will cancel CR using SQL query.

Thanks.

Actions

Mostafa Helmy

@ Maninder Bhamrah on Mar 26, 2020 6:30 AM

Please do not proceed this way. Closing CRs using SQL queries is a very bad practice and will never clean-up all dependencies as the UI would do.

For example here are some things that the proper cancel button from the UI will handle:

Clean up any pending accounts created in the CR.
Handle dependant change items in other CRs (for example: Add Entitlement to Account in CR2, where the Account is being created in to-be-cancelled CR1).
Change the status of any associated violations (for example: Pending Revoke to Open).
Properly close underlying workflows inside the CR.
Clean-up any Role Versions related to the CR in case of BRM, so Roles do not stay stuck in the "Applied” status or internal relations getting mixed up.

I know that you may be using a SQL script provided by RSA support at one point, but any of such scripts are provided to be run for a specific case and are not to be used to generally close CRs.

Here are some alternatives:

Cancel CRs from the UI
1. Got to Requests > Requests.
2. Select all CRs you want to cancel.
3. Click the "Cancel Requests (n)” button to bulk cancel all selected Requests.
Use any scripting language you want to run the cancelChangeRequest web service iteratively against multiple CRs (example attached).
On the most recent patches, you can now bulk cancel specific change request items from the UI.
1. Go to Requests > Activities > By Pending Verification.
2. Select the change items you want to cancel.
3. Click the "Cancel (n)” button to bulk cancel all selected items.
4. Once all items in a specific Request are completed or cancelled, the request should automatically get completed.

Attachments

CancelCRsWebServices.sh951 bytes

Actions

Maninder Bhamrah @ Mostafa Helmy on Mar 31, 2020 5:30 AM

Hi Mostafa,

Thankyou for your reply, we want to complete the CRs and we do not have option to complete the CRs from UI hence we need to do it from back-end and we will make sure the watches for such CRs are closed.

I just had another query, what if the CRs are completed but the watch is still open, or CR and watch related to the CR both are open, will it create any dependency factor if i proceed to completing the watch in first case and in second case just close the CR.

Wanted to know , is closing watch important or completing a CR alone is enough.

Thankyou.

Actions

Mostafa Helmy

@ Maninder Bhamrah on Mar 31, 2020 12:19 PM

Hi Maninder, I still believe cancelling/completing CRs using database scripts is a very bad practice and is guaranteed to create you further problems down the line.

I believe the correct way to handle this is to cancel the stuck items from the UI along with a comment explaining why these have been cancelled for audit purposes.

Regarding your second question, watches for properly completed change requests are actually deleted from the watch table.

Actions

Mohit Vohra @ Mostafa Helmy on Apr 3, 2020 2:46 PM

Hello Mostafa,

We were basing our approach [to use SQL script] as per the advice provided to us by RSA Engineering [Antoine Foti] for specific case so your present advice is contrary to the same and hence confusing. Request you to have a look and advise if we should go for UI based cancel of revoke or go as per the case [for which your Engg team gave us the script]?

Actions

Mostafa Helmy

@ Mohit Vohra on Apr 6, 2020 1:14 PM

Hey Mohit, I don't know the details of the support case. Database scripts may be provided for specific one-time cases, however it should not be reused as a generic solution going forward. As Ian suggested, please log another case with RSA Support to have a senior engineer review your case and give you specific recommendations.

The general recommendation here still stands which is NOT to use any database scripts to cancel/update change requests or workflows.

Actions

Andy Cheek Mar 26, 2020 6:27 AM

What version of the product are you on? Always helpful to specify.

What state are your CRs? If the CRs are complete but the individual changes are still Pending then you would almost certainly need to update directly. If the CRs are pending as well AND you're on 7.1 upwards then you can cancel pending changes from the Activities > Pending Verification tab - this will handle all the required updates under the covers … which is always a better option.

I can't imagine just closing the watch would do much to your CR though - I've got a small number of cases where the watch is no longer Open but the changes are still Pending, so I don't think there are automatic updates triggered that way (but happy to be corrected by someone at RSA who actually knows).

1 person found this helpful

Actions

Sean Miller

@ Andy Cheek on Mar 31, 2020 12:29 PM

Correct. Just closing the watch (especially via sql scripts) is not going to affect the workflow leaving the change request still pending. Mostafa and Andy's comments are the way you should go here. We rely on closed loop for a reason to ensure reality matches the expectations in the request. This is critical for auditors that may want to look at completed requests later on.

Actions

Mohit Vohra @ Andy Cheek on Apr 3, 2020 1:09 PM

Hi Andy,

We are using 7.0.2 P7 [and in parallel also working to upgrade our instance to 7.2 version but thats still atleast a month away with lot of testing etc going on at present].

We do have option of cancelling the change requests from UI but were a little confused by Mostafa's statement because we had raised a case with RSA support to get advice on how to run through it and got response in Sept 2019 to use SQL update statement.

Actions

Ian Staines

@ Mohit Vohra on Apr 3, 2020 3:05 PM

Mohit,

Please open a new case with RSA Customer Support. Ask specifically to have your case reviewed by a senior engineer. RSA Customer Support will review any previous guidance you may have been given to ensure it is in accordance with our best practices.

Actions

11 Replies

Mostafa Helmy Mar 24, 2020 10:08 AM
Mark Correct
Correct Answer
How do you intend to close a watch/CR?
Will you cancel the CR or will you actually modify the source data so that the changes get verified?
Like • Show 0 Likes0
Actions
- Maninder Bhamrah @ Mostafa Helmy on Mar 26, 2020 5:25 AM
  Mark Correct
  Correct Answer
  Hi,
  
  I will cancel CR using SQL query.
  
  Thanks.
  Like • Show 0 Likes0
  Actions
  - Mostafa Helmy @ Maninder Bhamrah on Mar 26, 2020 6:30 AM
    Unmark Correct
    Correct Answer
    Please do not proceed this way. Closing CRs using SQL queries is a very bad practice and will never clean-up all dependencies as the UI would do.
    
    For example here are some things that the proper cancel button from the UI will handle:
    Clean up any pending accounts created in the CR.
    Handle dependant change items in other CRs (for example: Add Entitlement to Account in CR2, where the Account is being created in to-be-cancelled CR1).
    Change the status of any associated violations (for example: Pending Revoke to Open).
    Properly close underlying workflows inside the CR.
    Clean-up any Role Versions related to the CR in case of BRM, so Roles do not stay stuck in the "Applied” status or internal relations getting mixed up.
    
    I know that you may be using a SQL script provided by RSA support at one point, but any of such scripts are provided to be run for a specific case and are not to be used to generally close CRs.
    
    Here are some alternatives:
    Cancel CRs from the UI
    Got to Requests > Requests.
    Select all CRs you want to cancel.
    Click the "Cancel Requests (n)” button to bulk cancel all selected Requests.
    Use any scripting language you want to run the cancelChangeRequest web service iteratively against multiple CRs (example attached).
    On the most recent patches, you can now bulk cancel specific change request items from the UI.
    Go to Requests > Activities > By Pending Verification.
    Select the change items you want to cancel.
    Click the "Cancel (n)” button to bulk cancel all selected items.
    Once all items in a specific Request are completed or cancelled, the request should automatically get completed.
    Attachments
    CancelCRsWebServices.sh951 bytes
    Like • Show 0 Likes0
    Actions
    - Maninder Bhamrah @ Mostafa Helmy on Mar 31, 2020 5:30 AM
      Mark Correct
      Correct Answer
      Hi Mostafa,
      
      Thankyou for your reply, we want to complete the CRs and we do not have option to complete the CRs from UI hence we need to do it from back-end and we will make sure the watches for such CRs are closed.
      
      I just had another query, what if the CRs are completed but the watch is still open, or CR and watch related to the CR both are open, will it create any dependency factor if i proceed to completing the watch in first case and in second case just close the CR.
      
      Wanted to know , is closing watch important or completing a CR alone is enough.
      
      Thankyou.
      Like • Show 0 Likes0
      Actions
      - Mostafa Helmy @ Maninder Bhamrah on Mar 31, 2020 12:19 PM
        Mark Correct
        Correct Answer
        Hi Maninder, I still believe cancelling/completing CRs using database scripts is a very bad practice and is guaranteed to create you further problems down the line.
        
        I believe the correct way to handle this is to cancel the stuck items from the UI along with a comment explaining why these have been cancelled for audit purposes.
        
        Regarding your second question, watches for properly completed change requests are actually deleted from the watch table.
        Like • Show 2 Likes2
        Actions
        Mohit Vohra @ Mostafa Helmy on Apr 3, 2020 2:46 PM
        Mark Correct
        Correct Answer
        Hello Mostafa,
        
        We were basing our approach [to use SQL script] as per the advice provided to us by RSA Engineering [Antoine Foti] for specific case so your present advice is contrary to the same and hence confusing. Request you to have a look and advise if we should go for UI based cancel of revoke or go as per the case [for which your Engg team gave us the script]?
        Like • Show 0 Likes0
        Actions
        Mostafa Helmy @ Mohit Vohra on Apr 6, 2020 1:14 PM
        Mark Correct
        Correct Answer
        Hey Mohit, I don't know the details of the support case. Database scripts may be provided for specific one-time cases, however it should not be reused as a generic solution going forward. As Ian suggested, please log another case with RSA Support to have a senior engineer review your case and give you specific recommendations.
        
        The general recommendation here still stands which is NOT to use any database scripts to cancel/update change requests or workflows.
        Like • Show 0 Likes0
        Actions
Andy Cheek Mar 26, 2020 6:27 AM
Mark Correct
Correct Answer
What version of the product are you on? Always helpful to specify.
What state are your CRs? If the CRs are complete but the individual changes are still Pending then you would almost certainly need to update directly. If the CRs are pending as well AND you're on 7.1 upwards then you can cancel pending changes from the Activities > Pending Verification tab - this will handle all the required updates under the covers … which is always a better option.
I can't imagine just closing the watch would do much to your CR though - I've got a small number of cases where the watch is no longer Open but the changes are still Pending, so I don't think there are automatic updates triggered that way (but happy to be corrected by someone at RSA who actually knows).
1 person found this helpful
Like • Show 1 Like1
Actions
- Sean Miller @ Andy Cheek on Mar 31, 2020 12:29 PM
  Mark Correct
  Correct Answer
  Correct. Just closing the watch (especially via sql scripts) is not going to affect the workflow leaving the change request still pending. Mostafa and Andy's comments are the way you should go here. We rely on closed loop for a reason to ensure reality matches the expectations in the request. This is critical for auditors that may want to look at completed requests later on.
  Like • Show 1 Like1
  Actions
- Mohit Vohra @ Andy Cheek on Apr 3, 2020 1:09 PM
  Mark Correct
  Correct Answer
  Hi Andy,
  
  We are using 7.0.2 P7 [and in parallel also working to upgrade our instance to 7.2 version but thats still atleast a month away with lot of testing etc going on at present].
  
  We do have option of cancelling the change requests from UI but were a little confused by Mostafa's statement because we had raised a case with RSA support to get advice on how to run through it and got response in Sept 2019 to use SQL update statement.
  Like • Show 0 Likes0
  Actions
  - Ian Staines @ Mohit Vohra on Apr 3, 2020 3:05 PM
    Mark Correct
    Correct Answer
    Mohit,
    
    Please open a new case with RSA Customer Support. Ask specifically to have your case reviewed by a senior engineer. RSA Customer Support will review any previous guidance you may have been given to ensure it is in accordance with our best practices.
    Like • Show 0 Likes0
    Actions

Does closing watches provides more efficiency than closing CRs

Outcomes

Attachments

Related Content

Recommended Content