+ Post New Thread
Page 1 of 5 12345 LastLast
Results 1 to 15 of 66
MIS Systems Thread, Urgent SIMS advice needed - Poss gross misconduct in Technical; Help! my Line manager has aasked me to investigate a possible case of GM involving SIMS Behaviour/Conduct Logs A member ...
  1. #1

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,678
    Thank Post
    861
    Thanked 650 Times in 431 Posts
    Rep Power
    499

    Urgent SIMS advice needed - Poss gross misconduct

    Help!

    my Line manager has aasked me to investigate a possible case of GM involving SIMS Behaviour/Conduct Logs

    A member of staff is suspected of deleting the logs of their own child..

    Is there anyway to find out when a log was removed and by whom?

  2. #2
    ICT_GUY's Avatar
    Join Date
    Feb 2007
    Location
    Weymouth
    Posts
    2,268
    Thank Post
    660
    Thanked 283 Times in 204 Posts
    Rep Power
    106
    I would contact you higher support as any interfering with the system could be prejudicial to legal action further on. County level support will be able to advise on how to proceed.

  3. #3
    DMcCoy's Avatar
    Join Date
    Oct 2005
    Location
    Isle of Wight
    Posts
    3,472
    Thank Post
    10
    Thanked 497 Times in 437 Posts
    Rep Power
    113
    http://support.capitaes.co.uk/websup...50832.xmlFalse

    Apparently not.

    System manager is also broken when you try and open the logs, using all the memory and crashing. Not that proper auditing is essential for when you want to enable remote access to sims etc, no, why ever would we need something as silly as that!

  4. #4

    vikpaw's Avatar
    Join Date
    Sep 2006
    Location
    Saudi Arabia
    Posts
    5,641
    Thank Post
    685
    Thanked 1,400 Times in 1,160 Posts
    Rep Power
    353
    Take a backup now. system manager can be done whilst system is live. now you can work with that. Also dump current server event logs.

    As far as i know, no there isn't. If you have daily backups you can maybe narrow down what day it occured, but only if it was done the day after the backup.

    System Manager will give you some logging, but it usually crashes my machine. worth a try though.

    SupportNet KB50832 - Is there anyway of finding out who made changes in SIMS .net?

    : only login sessions (along with the rights granted to a user at the time) are audited in the SQL Server database.

    Look at the event logs on SIMS server, i quite often see password failures, not sure if it logs success too. Again, may help you track it down.

    You'll need a lot of luck, in terms of the time of day, and who else might have been on the system at the time.

    Best thing to do is contact Capita or your support for the official advise, but also let your boss / the executive team know how hard it is to find such info.

  5. #5

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,678
    Thank Post
    861
    Thanked 650 Times in 431 Posts
    Rep Power
    499
    So capita Fail again by not including a proper audit trail!
    oh wonderful.. thanks so much Capita!

    I have rung our LA supoprt and waiting on a call back from them to see if there is anyway it can be traced..

  6. #6

    vikpaw's Avatar
    Join Date
    Sep 2006
    Location
    Saudi Arabia
    Posts
    5,641
    Thank Post
    685
    Thanked 1,400 Times in 1,160 Posts
    Rep Power
    353
    pipped me

  7. #7

    creese's Avatar
    Join Date
    Feb 2009
    Location
    -28° 31' 48.89", +28° 25' 37.42" ... if only.
    Posts
    3,256
    Thank Post
    182
    Thanked 375 Times in 304 Posts
    Rep Power
    174
    Not many logs are kept by SIMS. At least they are not accessible. Sending the data to Capita may get a result but it is too easy to delete behaviour entries.

    This should be a disiplinary matter but would be difficult at present to prove.

  8. #8

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,656
    Thank Post
    1,262
    Thanked 783 Times in 680 Posts
    Rep Power
    236
    Quote Originally Posted by vikpaw View Post
    As far as i know, no there isn't. If you have daily backups you can maybe narrow down what day it occured, but only if it was done the day after the backup.
    SIMS runs on top of MS SQL Server. When you "delete" a record in an SQL database, is it actually deleted straight away or simply marked as deleted and left for a clean-up process to deal with? Depending on when, exactly, the data was deleted, and how often any clean-up process runs, would it be possible to recover "deleted" records from an SQL database file?

    --
    David Hicks

  9. #9

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,678
    Thank Post
    861
    Thanked 650 Times in 431 Posts
    Rep Power
    499


    Capita will not speeak to me becuase the LEA are our supoprt contact

    That would be fine if the LEA actaully helped me

    so according to Capita Drone i need to

    Log call with LEA (done)
    LEA investigate my issue
    if LEA cannot find solution the LEA have to raise issue with Capita
    Capita then investigate and then pass back to LEA
    LEA then carry out whatever capita have advised them to do

    So its Me -> LEA -> CAPITA -> LEA -> ME

    /me not a happy chappy at this ridiculous process....

  10. #10

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,892
    Thank Post
    518
    Thanked 2,494 Times in 1,935 Posts
    Blog Entries
    24
    Rep Power
    839
    If there are no simple logs, how about pulling up a backup of the SIMS database from a while back, and comparing the tables? Laborious work I know, but its a possibility?

  11. #11

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,678
    Thank Post
    861
    Thanked 650 Times in 431 Posts
    Rep Power
    499
    Quote Originally Posted by dhicks View Post
    SIMS runs on top of MS SQL Server. When you "delete" a record in an SQL database, is it actually deleted straight away or simply marked as deleted and left for a clean-up process to deal with? Depending on when, exactly, the data was deleted, and how often any clean-up process runs, would it be possible to recover "deleted" records from an SQL database file?

    --
    David Hicks

    just been through the SQL DB - there is a table called sims.stud_behaviour - but either only a dozen people have recorded a behiouirs log this year or something is very wrong with this table as it goes back to 2001!

  12. #12

    TechMonkey's Avatar
    Join Date
    Dec 2005
    Location
    South East
    Posts
    3,295
    Thank Post
    226
    Thanked 406 Times in 303 Posts
    Rep Power
    162
    Would hassling the LEA & demanding an escalation be worth it? This would be massively time sensitive, potentially a DPA issue. Wave that at them may be a big enough stick.

    We have had the same problem with the lea>capita and back again route. Even had the lea tell us to phone capita direct to get something and then get pushed back to the LEA from them!

  13. Thanks to TechMonkey from:

    Gatt (17th June 2010)

  14. #13

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,892
    Thank Post
    518
    Thanked 2,494 Times in 1,935 Posts
    Blog Entries
    24
    Rep Power
    839
    Quote Originally Posted by Gatt View Post
    just been through the SQL DB - there is a table called sims.stud_behaviour - but either only a dozen people have recorded a behiouirs log this year or something is very wrong with this table as it goes back to 2001!
    I'm not sure on the table structure, but have a look in the views. There is more than likely a relevant one in there.

  15. Thanks to localzuk from:

    Gatt (17th June 2010)

  16. #14

    vikpaw's Avatar
    Join Date
    Sep 2006
    Location
    Saudi Arabia
    Posts
    5,641
    Thank Post
    685
    Thanked 1,400 Times in 1,160 Posts
    Rep Power
    353
    Quote Originally Posted by dhicks View Post
    SIMS runs on top of MS SQL Server. When you "delete" a record in an SQL database, is it actually deleted straight away or simply marked as deleted and left for a clean-up process to deal with? Depending on when, exactly, the data was deleted, and how often any clean-up process runs, would it be possible to recover "deleted" records from an SQL database file?

    --
    David Hicks
    You're far more knowledgable than me on the subject. I got the impression, deletions were final, and Capita state there is no logging. i've found similar when trying to track changes to assessment marks. the only logs they have to keep are for attendance marks.

    I've never done it, but i believe it is possible, to use backups of the transaction logs and play these back onto a full backup. This would still only narrow down the timeframe at best, as i don't know if it would record the person doing it. We set 5 transaction log backups to occur through the day via SQL management studio. After a few weeks i delete them.

    Quote Originally Posted by Gatt View Post
    just been through the SQL DB - there is a table called sims.stud_behaviour - but either only a dozen people have recorded a behiouirs log this year or something is very wrong with this table as it goes back to 2001!
    Quote Originally Posted by localzuk View Post
    I'm not sure on the table structure, but have a look in the views. There is more than likely a relevant one in there.
    I don't think looking at the tables will show anything, as it will only show data that is there, or on a backup that was there. I don't believe there is explicit logging aside from the SQL processes @dhicks; mentioned which presumably get deleted after.

    All you'll achieve is to work out when it was done, so unless it was after hours, it will be quite hard to track. You'll need to combine the soft evidence with facts about who was in school and logged into a computer at the time...

  17. #15

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,656
    Thank Post
    1,262
    Thanked 783 Times in 680 Posts
    Rep Power
    236
    Quote Originally Posted by Gatt View Post
    just been through the SQL DB - there is a table called sims.stud_behaviour - but either only a dozen people have recorded a behiouirs log this year or something is very wrong with this table as it goes back to 2001!
    The problem is, I assume any standard SQL tool built to browse through an SQL database is going to respect any "deleted" flags on records, hence it isn't going to show you tha data you want - you're going to need a forensics package of some sort that reads the SQL database directly without going through the SQL engine.

    --
    David Hicks

SHARE:
+ Post New Thread
Page 1 of 5 12345 LastLast

Similar Threads

  1. Urgent advice Please
    By jsnetman in forum Hardware
    Replies: 1
    Last Post: 23rd April 2009, 11:44 AM
  2. Urgent Help needed!
    By The_GuRu in forum Network and Classroom Management
    Replies: 27
    Last Post: 20th February 2008, 09:20 AM
  3. Replies: 12
    Last Post: 22nd October 2007, 07:15 PM
  4. advice needed on weather a new server is needed
    By projector1 in forum Hardware
    Replies: 3
    Last Post: 24th February 2006, 09:20 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •