title: Best approach to perform a CMMI Physical Configuration Audit?
body: <p>The organization I currently work for an organization that is moving into the whole CMMI world of documenting everything. I was assigned (along with one other individual) the title of Configuration Manager. Congratulations to me right. </p>
  
  <p>Part of the duties is to perform on a regular basis (they are still defining regular basis, it will either by quarterly or monthly) a physical configuration audit. This is basically a check of source code versions deployed in production to what we believe to be the source code versions in production. </p>
  
  <p>Our project is a relatively small web application with written in Java. The file types we work with are java, jsp, xml, property files, and sql packages. </p>
  
  <p>The problem I have (and have expressed but seem to be going ignored) is how am I supposed to physical log on to the production server and verify file versions and even if I could it would take a ridiculous amount of time? </p>
  
  <p>The file versions are not even currently in the file(i.e. in a comment or something). It was suggested that we place visible version numbers on each screen that is visible to the users also. I thought this ridiculous also, since the screens themselves represent only a small fraction of the code we maintain. </p>
  
  <p>The tools we currently use are Netbeans for our IDE and Serena Dimensions as our versioning tool. </p>
  
  <p>I am specifically looking for ideas on how to perform this audit in a hopefully more automated way, that will be both accurate and not time consuming.</p>
  
  <p>My idea is currently to add a comment to the top of each file that contains the version number of that file, a script that runs when a production build is created to create an XML file or something similar containing the file name and version file of each file in the build. Then when I need to do an audit I go to the production server grab the the xml file with the info, and compare it programmatically to what we believe to be in production, and output a report.</p>
  
  <p>Any better ideas. I know this has to have been done already, and seems crazy to me that I have not found any other resources.</p>