In trying to analyze grouper-provisioning behavior, we have detailed logging enabled and this gives us attribute-by-attribute changes. For Entitlement provisioning, we have what we need, but for Group Provisioning, it is much harder to analyze for two reasons:

1) Group deletion logs a membership-deletion for every member in the target system

2) Membership changes (ins member/del member) are logged with just the member info and not the group identity. (The group involved in the 'ins member/del member' is logged before the list of membership changes, but that can be a very long list and hard to analyze.

 

For example: