CA Spectrum Tuesday Tip by Roger Nason, Principal Support Engineer, April 19, 2012
How to enable logging of user events
Description: When a model is destroyed, or other change is made to the SpectroSERVER’s database events are not being logged indicating what user did a specific task. User event logging functionality is available within Spectrum; however, this functionality is disabled by default.
To enable the user event logging functionality, you will need to edit the $SPECROOT/SS/.vnmrc file. The log_user_events entry must be set to true.
This .vnmrc entry controls whether an event is generated for each user-initiated write to a model attribute value. A value of True causes the VNM to generate events.
The SpectroSERVER will need to be restarted for this change to take effect.
NOTE: In most environments this will generate a considerable number of events and combined with the normal event processing flow this could affect performance. Enable with caution.
Sample User Events:
User placed a model in hibernation mode:
Event: User email@example.com modified attribute isNotHibernating (0x12aca) of 10.137.135.208
(Pingable) to FALSE. Success (CsError=0).
Event Type: 0x1010a
User destroyed a Spectrum device model:
Event: A model has been destroyed. The model was sprint of type CiscoNXOS destroyed by firstname.lastname@example.org.
Event Type: 0x10202
User took a model out of maintenance mode:
Event: GnSNMPDev (name - SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME): The device model has been taken out of Maintenance Mode by user email@example.com.
Event Type: 0x10223
User changed the IP address on a model:
Event: User firstname.lastname@example.org modified attribute Network_Address (0x12d7f) of SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME
Event Type: 0x1010a
User manually cleared an alarm:
Event: User email@example.com cleared alarm number 171177 with probable cause id 0x1030a for device nasro04-sim-01.ca.com of type Host_Device.
Event Type: 0x10706 (This, as well as the other user alarm events, are filtered out of the event tab view by default)