找出谁将离开公司:转储、差异、重复
Figure out who's leaving the company: dump, diff, repeat

原始链接: https://rachelbythebay.com/w/2024/02/08/ldap/

倾销和差异发现离职:通过软件分析了解公司的员工流动率 在许多组织中,弄清楚谁辞职或跳槽可能是一项艰巨的任务。 然而,使用简单的脚本技术分析软件日志可以提供有价值的见解,节省时间和资源,同时允许利益相关者更好地管理离开。 在本文中,我们探讨了一种通过转储和比较系统日志来识别员工流动率的方法。 在大公司中,通常有一个集中的目录服务来跟踪每个用户的就业状态。 这些服务称为轻量级目录访问协议 (LDAP),允许用户通过电子邮件、用户名和密码验证其帐户。 通过监控这些系统,个人可以观察员工水平随时间的变化。 该系统在实践中的一个例子发生在一家中型科技公司,该公司采用了一项名为“Epitaphs”的服务——一种记录人事记录更改的档案。 每个离职者都会收到一个专门的网页,其中显示了离职原因和未来计划等信息。 剩下的人经常使用该网站作为参考点来检查有关前同事的更新。 另一种方法涉及使用自动化脚本定期收集日志以进行比较。 一位作者曾经创建了他/她自己的该策略版本,每天两次从他的本地开发计算机记录用户帐户详细信息。 输出被编译成一个包含唯一字段(例如用户 ID、访问日期等)的日志文件,从而减少混乱并有助于更快地检索目标查询。 尽管这个过程看起来很简单,但有一些注意事项需要考虑。 例如,如果出现技术问题导致日志生成或比较失败或产生误报,则可能会导致严重后果。 因此,在整个组织范围内实施永久解决方案之前,必须确定并解决这些问题。 此外,随着企业的发展,自动化系统发生故障的可能性也会增加,从而导致所有工人突然消失的错误结论。 因此,这种技术应该始终伴随着仔细的监督和应急计划,以及定期的软件维护。 尽管有其局限性,但通过软件分析记录员工流动率可以带来巨大的好处,包括通过减少体力劳动需求来节省时间和提高运营效率。 无论是利用现有的 Epitaphs 数据库还是开发适合特定业务需求的自定义代码,跟踪系统的实施都可以提供有关人类的宝贵房地产信息。

根据所提供的文章,根据欧盟法律,特别是《通用数据保护条例》(GDPR),使用 Active Directory 查找被解雇的员工如何被视为滥用行为? 违反此规则是否会受到处罚?如果有,处罚的程度是多少? 此外,公司如何处理在收集和存储与员工相关的个人信息时可能违反该法规的行为,特别是在隐私问题方面?
相关文章

原文

One common element of the larger places where I've worked is that they tend to have a directory service of some sort that keeps track of who's an employee and who isn't. You can learn some interesting things by periodically dumping that list and then running comparisons against the previous dump.

A certain company had this rolled up into an internal service called "epitaphs" where an entry for a person would appear a day or two after they "disappeared from LDAP" - meaning, they left the company. Then other people who still worked there could add comments like "went back to school", "moved to Idaho to raise sheep", that kind of thing.

This had an interesting side-effect that you couldn't write to your own "epitaph" because by definition you had to already be gone from the company for your page to exist. Someone else who knew you had to add it. I actually received an e-mail to that effect one time: "I'm leaving, so when it shows up, please add XYZ". I was pleased that they trusted me to do that, and a few days later, I pasted it in as requested.

Another place I worked didn't have anything quite like this. There was the "internal profile" where you could see that so and so worked at the company from to , but there wasn't any sort of periodic update available. I decided to roll my own. It didn't take much in the way of effort, really. A cron job on my dev server (a physical box in a datacenter with access to my home directory) woke up a couple of times every day and dumped the entire list to a file. Then it compared it to the last one, crunched it down to just the uid (unix account name) field, and appended the results to a log file.

Over time, various other people learned about this, and since I had left it world-readable, they were able to leave up a "tail -f " to keep tabs on it, and sometimes something surprising would show up during the day. People would sometimes just vanish. Other times, there were bizarre things going on that added a bit of context.

The log entries looked like this:

Thu Feb 08 18:26:42 PST 2024 : uid: 

That was enough to let you go digging and find out more if you actually gave a damn about why that particular person no longer worked there. Otherwise, it didn't flood you with useless data.

One time, I pasted in a line like that into an IRC channel and that popped up and said "yeah, I don't work here any more". It turned out their account had been deactivated, but they still had a client connected. When I mentioned their account name, they got a notification, flipped to that window, and replied. We had a few minutes to chat about it.

It was weird saying farewell to someone that way. Normally, the electronic lines of communication are severed early on. I think what happened here is that the IRC servers only checked auth at connect-time, and then nothing went back to make sure that sessions remained associated with current employees. (It's a bit of a hard problem.)

Another time, some manager type said they were going to be late for a meeting because of some "dumb manager thing" they had to do. Sure enough, a few minutes into that meeting, a line scrolled across showing the deactivation of an account of one of their direct reports. Obviously, they had to go into one of those HR meetings where they showed someone the door.

I'd say the best time to start doing this is when you start at a company, or when that company grows big enough to actually have LDAP or whatever. That means the second-best time would be today.

Incidentally, the 'comm' tool is great for this sort of thing.

comm -2 -3 

... and there you go.

Now, this sort of thing is not perfect. If you don't catch errors, the first time it fails to dump and yet diffs a full list against an empty list, it'll look like everyone quit. This is not what you want. Also, once you work at a big enough company, there WILL be days when some automation will run amok and "fire" everyone, and every account will be deactivated. This will happen more than once if you stay there long enough.

Incidentally, if someone gets mad about you running this sort of thing, you probably don't want to work there anyway. On the other hand, if you're able to build such tools without IT or similar getting "threatened" by it, then you might be somewhere that actually enjoys creating interesting and useful stuff. Treasure such places. They don't tend to last.

联系我们 contact @ memedata.com