How to view users created logs in Spectrum administration under client log.

[rk_mahato]

How to view users created logs in Spectrum administration under client log.

 

 

Also we are advised to apply the below resolution. But for production infra it's not recommandable as it will impact the database by populating the logs.

https://support.ca.com/us/knowledge-base-articles.TEC516965.html

Description: The log_user_events resource controls whether the VNM generates an event for every database or external write to the VNM.

 Syntax: log_user_events=False

where:

 False is the default value and causes the VNM not to generate events. A value of True causes the VNM to generate events.

 

However we can see the user's deleted logs under client log . Kindly help on this & screenshot attached for your ref.

[Silvio Okamoto]

When you set  log_user_events=true in the $SPECROOT/SS/.vnmrc file, user events are stored in the historical database (Archive Manager's DDMdb). 

This is useful when you want to know who has destroyed a model.

 

Here are the steps to find the account that destroyed a model:

 

1. In Navigation panel, Explorer tab, select the SpectroSERVER model handle
( <hostname> (0x400000) for example)

2. In Contents panel, select the Events tab

3. Click on Filter button
The Event Filter window will pop-up

4. Select the Avanced tab and fill in as follows:
Attribute: Event Type
Comparison Type: Equal To
Attribute Value: 0x10202

5. Then click on OK button

6. In the Events tab you should see the filtered event (in this case, 0x10202 - A model has been destroyed).

 

7. In "Created By" column you should see the account that deleted the model.

 

What you are actually seeing in the Client Log is a message that someone has destroyed the "1506509" account. Hence the 1506509 has been logged off from the OneClick host.

There is no relationship between the message below (in the Client Log) with the log_user_events=true in the $SPECROOT/SS/.vnmrc file:

 

Jul 11, 2016 11:34:11 AM - SPC-OCA-10602: User 1506509 has been logged off from host 10.132.55.4 (10.132.55.4). The user model has been deleted from all landscapes. 

 

Thanks,

Silvio

[rk_mahato]

Hi Silvio,

Appreciated your response.

Moreover I'm looking the logs for user accounts creation/deletion under client log in adminstration page or in our spectroservers. Let me know if there is any feasibility.

[Silvio Okamoto]

Only the account deletion is logged in the Client Log (in OC web page).

 

But the account creation event is logged in the Archive Manager. 

Set  log_user_events=true in the $SPECROOT/SS/.vnmrc file. You may need to restart the SpectroSERVER.

 

Apply the following filter in the Events TAB to display the model creation event:

Select the Avanced tab and fill in as follows:
Attribute: Event Type
Comparison Type: Equal To
Attribute Value: 0x10201

 

Here is the event you are looking for:

 

Thanks,

Silvio

[rk_mahato]

Hi Silvio,

Thanks for your clarification & approach on the above query.

 

 

Regards

Rajesh Kumar

[Widjaja Sangtoki]

The raw file is $SPECROOT/OCLogs/client.log on OneClick Server machine. It has its own format. You can see the Client log contents from that file.

[rk_mahato]

Hi Widjaja,

Thanks for your response , I tried the same but there is no fruitful result.

There are no logs available for user account creation/deletion but however we can view the logs for logon/logout/session timeout.

Kindly let me know , if there is any feasibility to view logs for user accounts created/deleted . 

[Widjaja Sangtoki]

Hi Rajesh,

 

Sorry for confusion. The $SPECROOT/OCLogs/client.log file is the data source you are seeing in Client Log website page. If you want to get log data for user account creation/deletion please see what okasi01 has described above. You can only get the log data from OneClick Console event, not in the Client Log website. The log of user events are recorded in Archive Manager database (DDMdb) in MySQL database. OneClick Console retrieves the data and present it on its Events tab.

I hope this clears your doubts.

 

Regards,

Widjaja 

[rajani.ov]

Hi Widjaja/Silvio,

 

Recently explored an option with Locater Search tab in Spectrum for User account log details. Its feasible & working as expected for me. Navigate to Locater Tab and Create a New Search.

 

 

Search attributes has User Full Name (0x10074) and Model Type Name (0x10000) which is creating an expression ------ User Full Name Contains "" AND Model Type Name Matches Wildcard "User"

 

 

 

The search is giving the time the user was created or modified. Refer the screenshot below.

 

 

Any feedback is welcomed.

 

Likewise please share if there are any feasibility for User deletion logs in OneClick.

 

 

Regards,

Rajani