Reporting and Monitoring Mass Operations
Mass operations (onboarding and password reset) provide two methods for monitoring and reporting:
SQLite Database Reporting: Detailed operation-level tracking when enabled
REST API Monitoring: Real-time session log access through API endpoints
Method 1: SQLite Database Reporting
Enabling SQLite Reports
Configure SQLite reporting through the external data store in the hid_global_configuration table:
Log in to Bravura Pass as a product administrator.
Click Manage external data store.
Navigate to the
hid_global_configurationdata table.Configure the rules listed below.
Mass Password Reset Operations:
Namespace:
MASS_PASSWORD_RESETSetting:
REPORTValue:
True
Mass Onboarding Operations:
Namespace:
MASS_PASSWORD_ONBOARDSetting:
REPORTValue:
True
When enabled, it automatically generates SQLite reports for all operations.
SQLite Report Location:
File name:
mass_onboard*.dbormass_password_reset*.dbLocation:
C:\Program Files\Bravura Security\Bravura Security Fabric\Logs\<instance>
Database Schema
CREATE TABLE operation (
id TEXT NOT NULL, -- Account/User identifier
host TEXT NOT NULL, -- Target system
name TEXT NOT NULL, -- Account/User name
type TEXT NOT NULL, -- Operation type (account, group, new_group)
phase TEXT NOT NULL, -- Process phase
result TEXT NOT NULL, -- success/failure
details TEXT -- Error details (populated on failure)
);
Mass Operation Phases
user-group-create (
type: new_group): Creates new groups in target systemsuser-group-member-add (
type: group): Adds users to groupsgenerate-passwords (
type: account): Creates passwords for new accountsreplace-passwords (
type: account): Deploys passwords to target systems
generate-passwords (
type: account): Creates new passwords for existing accountsreplace-passwords (
type: account): Deploys passwords to target systemssynchronize-to-vault (
type: account): Synchronizes passwords to vault system
Key SQLite Reporting Queries
SELECT
result,
COUNT(*) as total_operations,
ROUND(COUNT(*) * 100.0 / (SELECT COUNT(*) FROM operation), 2) as percentage
FROM operation
GROUP BY result;
SELECT
phase,
result,
COUNT(*) as count,
ROUND(COUNT(*) * 100.0 / SUM(COUNT(*)) OVER (PARTITION BY phase), 2) as phase_percentage
FROM operation
GROUP BY phase, result
ORDER BY phase, result;
SELECT
host,
type,
COUNT(*) as operations,
SUM(CASE WHEN result = 'success' THEN 1 ELSE 0 END) as successful,
SUM(CASE WHEN result = 'failure' THEN 1 ELSE 0 END) as failed
FROM operation
GROUP BY host, type
ORDER BY host, type;
SELECT
phase,
type,
COUNT(*) as failure_count,
details
FROM operation
WHERE result = 'failure'
GROUP BY phase, type, details
ORDER BY failure_count DESC;
SQLite Monitoring Recommendations
Alert Thresholds
Overall success rate below 90%
Any phase with success rate below 80%
Repeated failures on specific systems
Vault synchronization success rate below 70%
Troubleshooting Workflow
Check overall success rate across all phases.
Identify problematic phases using per-phase breakdown.
Analyze system-specific failures.
Review error details for specific failure patterns.
Correlate failures with system availability or configuration changes.
Method 2: REST API Reporting
Prerequisites
Required User Classes:
_REPORT_READERS_: Provides access to session log data_EXPLICIT_REST_API_USERS_: Enables REST API authentication
Session Log Queries
GET /api/rest/v2/sessionLogs
$filter=operation eq 'OPC4'
$expand=requester,data
$orderby=metadata/lastUpdatedDateTime desc
GET /api/rest/v2/sessionLogs
$filter=operation eq 'CRTG'
$expand=requester,data(expand=group,targetSystem)
$orderby=metadata/lastUpdatedDateTime desc
GET /api/rest/v2/sessionLogs
$filter=operation eq 'GRUA'
$expand=requester,data(expand=account,targetSystem,group)
$orderby=metadata/lastUpdatedDateTime desc
GET /api/rest/v2/sessionLogs
$filter=operation eq 'ACUA'
$expand=requester,data(expand=account,targetSystem)
$orderby=metadata/lastUpdatedDateTime desc
GET /api/rest/v2/sessionLogs
$filter=operation eq 'ACHG'
$expand=requester,data(expand=account,targetSystem)
$orderby=metadata/lastUpdatedDateTime desc
Operation Codes
Mass Password Reset:
OPC4Group Creation:
CRTGGroup Assignment:
GRUAAccount Creation:
ACUAPassword Change:
ACHG
Batch ID Correlation
Operations within the same mass process share a common batchId in the session logs, enabling correlation between:
High-level mass operation requests (OPC4)
Individual component operations (CRTG, GRUA, ACUA, ACHG)
Error Handling
Common Error Scenarios
Lock Timeout: Another mass operation is running
Invalid Targets: Target systems not found or not configured
REST API Failures: Authentication or connectivity issues
Password Generation Failures: Policy violations or system errors
Account Update Failures: Permission or connectivity issues
Result Types
Success: All operations completed successfully
Partial: Some operations failed, some succeeded
Failure: All operations failed
NoInitialToken: Failed to authenticate with REST API
NotPrimaryNode: Operation attempted on non-primary cluster node
LockTimeout: Could not acquire exclusive lock
Common Error Patterns
HTTP 500 Internal Server Error: System integration issues
API Endpoint Issues: Network or authentication problems
Authentication Failures: Credential or permission issues
Vault Synchronization Errors: Vault system connectivity or configuration issues
See also
For complete REST API documentation and examples, refer to the Postman collection: REST API Documentation.
For information on reporting using the REST API, see API-driven reporting.
Reporting on mass password reset operations
Workflow integration
The Mass Password Reset scenario component integrates with Bravura Fabric workflow through the following pre-defined requests (PDRs) for authorization and execution:
MPR_ONBOARD (operation CUST66) - Mass Password Onboard
MPR_RESET (operation CUST65) - Mass Password Reset
The PDRs perform the specified operations through REST API calls.