Team issue tracking with Redmine

Two years ago, while struggling with SOX audits, one of the things I was asked to do by the auditors was to deploy an issue tracking / helpdesk program for my IT team. There are a whole bunch of issue tracking programs available, but my entire IT team consists of five people, including me. All of the issue tracking programs I looked at were too complex, too expensive, not internationalized (e.g., doesn't support dd/mm/yy format), or all of the above.

I didn't forget the open source projects such Trac, Mantis, OTRS, or Redmine, but they all seemed to experimental or overly complex due to feature creep, and I really wanted something online that could be accessed from anywhere. I kept stalling this project but I've kept my eye on things for the past two years. Recently though, my projects have gotten complex enough that I actually needed an issue tracking system myself, and not just for satisfying the auditors.

Redmine 1.0.1 ("very stable release") was released not long ago, and when I looked at it, it has just the right features for my team to use. Oh, before I finally decided on Redmine, I was almost going to go with Pivotal Tracker. Pivotal Tracker is free and has just the right features for me as well, but the website and its AJAX interface was somewhat slow, but this maybe due to my Internet connectivity.

I decided to install BitNami's native Redmine stack for Windows since I already have some Windows terminal servers. I could've rolled my own Linux server, but those Windows servers are mostly idle enough to run an additional service. I've already used BitNami many times in the past, and BitNami Redmine installed without a hitch.

Unfortunately, when I tried to set up email notifications according to these instructions, it didn't quite work for the Windows native stack version, probably because some of the expected commands such as ruby or git aren't automatically in the path, but I kept getting "plugin not found error".

My solution was to download the TLS plugins files as a source archive directly from the git repository, and extract it into "C:\Program Files\BitNami Redmine Stack\apps\redmine\vendor\plugins". I also renamed the extracted folder into "action_mailer_optional_tls" like the git installer does, but I don't know if that's necessary.

After that I made the necessary changes to email.yml according to the instructions in the website above, and it all worked, right on the first try.

(NOT! It not just didn't work on the first try, I spent like three hours on this thing with like five different versions of smtp_tls.rb and tls_smtp.rb placed into various folders, I tried different settings in email.yml, I tried editing production.rb and environment.rb to include the plugin. All because I read that the plugin wasn't necessary any more since TLS support is now built-in, etc. etc. Finally I downloaded BitNami's openSUSE Redmine virtual appliance and installed the plugin there using git to see which files get changed, then manually did the installation in Windows. No thanks to outdated and contradictory documentation floating around on the web.)

Ahem, anyway, while writing this I realized Redmine doesn't have an official logo. I really like the one Cyber Sprocket Labs uses, plus the favicon displayed by Redmine is also the same red arch. I also installed the Watersky theme to remind myself of the babes at the beach rather than burying myself in managing projects. (See picture above.)

Finally, Redmine does have an issue accepting date formats in our local preferred dd/mm/yy format in date input fields. But this is a relatively minor issue since all date input fields have a handy pop-up date picker tool.

IT audits

 

I was writing about IT auditing earlier, and since I'm facing more IT audits next week, so I decided to do a Google image search for a related image and make a post about it. The above was one of the first matches on the image search.

However, this is what IT audits look like in real life. I want that hot chick to be my auditor too.

Death, taxes, and Sarbanes-Oxley

My company is part of a group of companies that jointly form a very large corporation that's a leader in our manufacturing field here in Asia. So of course the shareholders decided to take the company public in the United States to make even more money.

All that probably wouldn't have make any difference to us little ants^H^H^H^Hemployees, but then the American law dictates that foreign companies must follow the Sarbanes-Oxley Act (better known as SOX) if they are to be listed in the United States. One day early this year, I got an e-mail telling me to be prepared for Sox audits that are to be completed before the middle of the year.

How hard could it be? I mean, there's even a Sarbanes-Oxley For Dummies book and I've read all about SOX after Enron and Worldcom happened. But when the SOX consultants actually came in and started asking for documentations and evidence of everything we do, I realized how much trouble I was in. The consultants didn't seem to have any idea about the workings of manufacturing plants as opposed to banking or financial institutions, and they expected us to change our working ways within weeks. The SOX consultants are also hired by the corporate headquarters and had trouble communicating with our non-English speaking employees (all of them).

Eventhough SOX is mostly about finance and accounting, IT also plays a major part in these modern days where everything is computerized. The biggest hurdle for my little IT team was that programmers must not talk to users (only system analysts can) or touch the database (only database admins can), and there has to be a separate IT manager who is not the sysadmin to approve everything that everyone is doing what they're supposed to do. This all sounds nice and secure for very large corporations with infinite manpower, but we only have a very small team handling a very large number of users and projects, and of course, I'm the sysadmin slash IT manager slash Mr. Fix-it-all.

The second hurdle was that they expected all of my users to have individual accounts for every user. This again sounds nice and secure in theory, but in our manufacturing plant where users have to key in the manufacturing data, how are we supposed to expect every user to log off after every data entry?! And we have subcontractors (temp workers) that come in and go on a day's notice. How can the IT Dept. possibly keep up with them to generate accounts when even the HR Dept. has trouble keeping up with the temp workers?

The third hurdle was that they wanted a fully computerized helpdesk system where the users have to describe in detail their IT service request including the scope, definition, reason, and detail of the request. Most of my users are computer illiterate!

This article (which is also the title of this post) sums up my feelings nicely.

Strangely enough, the best thing that I got out of all this was that the local SOX consultant we hired was a babe.