How to log user events in Spectrum
search cancel

How to log user events in Spectrum

book

Article ID: 135266

calendar_today

Updated On:

Products

CA Spectrum DX NetOps

Issue/Introduction

When a model is destroyed, or other change is made to the SpectroSERVER’s database events are not being logged indicating what user did a specific task. User event logging functionality is available within Spectrum; however, this functionality is disabled by default.

 

Environment

Release : Current supported releases

 

Resolution

To enable the user event logging functionality, you will need to edit the $SPECROOT/SS/.vnmrc file. The log_user_events entry must be set to true.

log_user_events=true

This .vnmrc entry controls whether an event is generated for each user-initiated write to a model attribute value. A value of True causes the VNM to generate events.

The SpectroSERVER will need to be restarted for this change to take effect. Or you can reload the change made in the $SPECROOT/SS/.vnmrc file to put the change in place:

Reload Spectrum VNM .vnmrc resource file using CLI action=0x10700
https://knowledge.broadcom.com/external/article?articleId=190121

NOTE: In most environments, this will generate a considerable number of events, and combined with the normal event processing flow this could affect performance. Enable with caution.

 

Sample User Events:

 

User placed a model in hibernation mode:

Event: User user@host modified attribute isNotHibernating (0x12aca) of IP

(Pingable) to FALSE. Success (CsError=0).

 

Event Type: 0x1010a



User destroyed a Spectrum device model:

Event: A model has been destroyed. The model was sprint of type CiscoNXOS destroyed by user@host.

Event Type: 0x10202

 

User took a model out of maintenance mode:

Event: GnSNMPDev (name - SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME): The device model has been taken out of Maintenance Mode by user user@host.

Event Type: 0x10223

 

User changed the IP address on a model:

Event: User user@host modified attribute Network_Address (0x12d7f) of SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME

Event Type: 0x1010a

 

User manually cleared an alarm:

Event: User user@host cleared alarm number 171177 with probable cause id 0x1030a for device host.ca.com of type Host_Device.

Event Type: 0x10706 (This, as well as the other user alarm events, are filtered out of the event tab view by default)

Additional Information

How to check the logs once User Events has been enabled: https://knowledge.broadcom.com/external/article?articleId=10255