How to log user events in Spectrum
search cancel

How to log user events in Spectrum


Article ID: 135266


Updated On:


CA Spectrum DX NetOps


When a model is destroyed, or other change is made to the SpectroSERVER’s database events are not being logged indicating what user did a specific task. User event logging functionality is available within Spectrum; however, this functionality is disabled by default.



Release : Current supported releases



To enable the user event logging functionality, you will need to edit the $SPECROOT/SS/.vnmrc file. The log_user_events entry must be set to true.


This .vnmrc entry controls whether an event is generated for each user-initiated write to a model attribute value. A value of True causes the VNM to generate events.

The SpectroSERVER will need to be restarted for this change to take effect. Or you can reload the change made in the $SPECROOT/SS/.vnmrc file to put the change in place:

Reload Spectrum VNM .vnmrc resource file using CLI action=0x10700

NOTE: In most environments, this will generate a considerable number of events, and combined with the normal event processing flow this could affect performance. Enable with caution.


Sample User Events:


User placed a model in hibernation mode:

Event: User user@host modified attribute isNotHibernating (0x12aca) of IP

(Pingable) to FALSE. Success (CsError=0).


Event Type: 0x1010a

User destroyed a Spectrum device model:

Event: A model has been destroyed. The model was sprint of type CiscoNXOS destroyed by user@host.

Event Type: 0x10202


User took a model out of maintenance mode:

Event: GnSNMPDev (name - SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME): The device model has been taken out of Maintenance Mode by user user@host.

Event Type: 0x10223


User changed the IP address on a model:

Event: User user@host modified attribute Network_Address (0x12d7f) of SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME

Event Type: 0x1010a


User manually cleared an alarm:

Event: User user@host cleared alarm number 171177 with probable cause id 0x1030a for device of type Host_Device.

Event Type: 0x10706 (This, as well as the other user alarm events, are filtered out of the event tab view by default)

Additional Information

How to check the logs once User Events has been enabled: