DX NetOps

 View Only
  • 1.  Tuesday Tip:  How to enable user event logging

    Broadcom Employee
    Posted Apr 09, 2012 06:47 PM

    CA Spectrum Tuesday Tip by Roger Nason, Principal Support Engineer, April 19, 2012

    How to enable logging of user events

    Description: When a model is destroyed, or other change is made to the SpectroSERVER’s database events are not being logged indicating what user did a specific task. User event logging functionality is available within Spectrum; however, this functionality is disabled by default.

    Solution:
    To enable the user event logging functionality, you will need to edit the $SPECROOT/SS/.vnmrc file. The log_user_events entry must be set to true.

    log_user_events=true

    This .vnmrc entry controls whether an event is generated for each user-initiated write to a model attribute value. A value of True causes the VNM to generate events.

    The SpectroSERVER will need to be restarted for this change to take effect.

    NOTE: In most environments this will generate a considerable number of events and combined with the normal event processing flow this could affect performance. Enable with caution.

    Sample User Events:

    User placed a model in hibernation mode:
    Event: User nasro04@10.132.3.67 modified attribute isNotHibernating (0x12aca) of 10.137.135.208
    (Pingable) to FALSE. Success (CsError=0).

    Event Type: 0x1010a


    User destroyed a Spectrum device model:
    Event: A model has been destroyed. The model was sprint of type CiscoNXOS destroyed by nasro04@10.132.3.67.
    Event Type: 0x10202

    User took a model out of maintenance mode:
    Event: GnSNMPDev (name - SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME): The device model has been taken out of Maintenance Mode by user nasro04@10.132.3.67.
    Event Type: 0x10223

    User changed the IP address on a model:
    Event: User nasro04@10.132.3.67 modified attribute Network_Address (0x12d7f) of SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME
    Event Type: 0x1010a

    User manually cleared an alarm:
    Event: User nasro04@10.132.3.67 cleared alarm number 171177 with probable cause id 0x1030a for device nasro04-sim-01.ca.com of type Host_Device.
    Event Type: 0x10706 (This, as well as the other user alarm events, are filtered out of the event tab view by default)



  • 2.  RE: Tuesday Tip:  How to enable user event logging

    Posted Apr 13, 2012 10:50 AM
    Thank you Roger for providing this tip on enabling user event logging to the community.

    Mary


  • 3.  RE: Tuesday Tip:  How to enable user event logging

    Posted Apr 13, 2012 11:35 AM
    Good tip Roger,

    talking about this, is there any way to log what user made changes in the Event Configuration?

    I found a way to figure it out through the tomcat log, but i would hope there would be a more "friendly" way to do it through Spectrum


    Thanks,
    Daniel


  • 4.  RE: Tuesday Tip:  How to enable user event logging

    Broadcom Employee
    Posted Apr 15, 2012 06:03 PM
    Hi Daniel,

    The only logging I am aware of, and it is not much in regards to auditing, is in $SPECROOT/tomcat/logs/localhost_access_log.<DATE>.txt

    In the examples below: my user nasro04 from client 138.42.90.133 made some Event Configuration changes within the UI.

    138.42.90.133 – nasro04 [04/Apr/2012:16:42:32 -0400] “POST /spectrum/ec/nextEventCode HTTP/1.1” 200 194
    138.42.90.133 - - [04/Apr/2012:16:43:43 -0400] “GET /spectrum/event-config/do/alarmPCause?format=text&pcause=4293922037 HTTP/1.1” 404 952
    - Created a new event
    138.42.90.133 – nasro04 [04/Apr/2012:16:43:56 -0400] “POST /spectrum/event-config/writepcause HTTP/1.1” 200 104
    -Modified an existing event to generate an alarm
    138.42.90.133 – nasro04 [04/Apr/2012:16:43:56 -0400] “POST /spectrum/ec/updateEvents HTTP/1.1” 200 148
    - Saving the events

    I hope this helps.

    -Roger


  • 5.  RE: Tuesday Tip:  How to enable user event logging

    Posted Apr 17, 2012 08:30 AM
    Hi Roger,

    yeah, that was the one way i founded too. Is it not very friendly but at least it does the job,

    thanks anyway,
    cheers,
    Daniel


  • 6.  RE: Tuesday Tip:  How to enable user event logging

    Posted Apr 18, 2012 03:35 AM
    hi roger,

    Is it possible to maintain some log file for some device port (connection) history ?

    -- krishna


  • 7.  RE: Tuesday Tip:  How to enable user event logging

    Posted May 02, 2012 01:47 AM
    Hi Krishna,

    The events on the interface should give you the connectivitiy information.You may need to check the events on the parent model as well.The user logging specified here logs the activities perfomred by any user model on the Spectroserver database.

    kalyan


  • 8.  Re: Tuesday Tip:  How to enable user event logging

    Posted Nov 05, 2014 05:34 AM

    Just noticed that if log_user_events is set to any arbitrary string, it works also. It does not need to be "true".

    Veronique