Archiving The Actlog

I just had a friend e-mail me and state he was being contacted by his previous employer complaining he made changes to their TSM retention times causing them to lose data. The TSM admin who took over is blaming him stating he changed the retention and now the data is gone. My friend does not remember making any retention changes and the problem is that any change to the copygroup updates the "Last Update by (administrator)" and the "Last Update Date/Time" so it's not substantial evidence of who did what. The only way to verify what had really occurred would be to either keep the actlog for an extremely long period of time, or dump it to a text file that you zip and archive. (Even then it's a text file and could be tampered with) In the case of my friend, he left the company last November and anyone could have altered the copygroup since then.

How many of you archive your TSM Activity Log, and how long do you keep it for? Obviously it good for security and tracking purposes, but who manages it and can you reliably keep it in a read-only state? Of course this is also a case where a bi-monthly audit of retention settings would have helped.

TSM Client Restore/ActLog Issue

So one of my colleagues kicked off a restore and upon doing an ActLog query for an unrelated issue it was noticed that every file restored was reporting in the TSM ActLog. Does anyone know why when I run a restore the ActLog is listing every file restored for a Windows client? I have never seen this happen before and not sure what setting is allowing it. Is this new in one of the 5.3.x releases or am I missing something? This can have a huge impact on ActLog size so I am a little concerned. I am used to seeing this in the DSMSCHED.LOG not the TSM ActLog.