How to log user events in Spectrum
Article ID: 135266
Updated On:
Products
Issue/Introduction
When a model is destroyed, or other change is made to the SpectroSERVER’s database events are not being logged indicating what user did a specific task. User event logging functionality is available within Spectrum; however, this functionality is disabled by default.
Environment
Release : Current supported releases
Resolution
To enable the user event logging functionality, you will need to edit the $SPECROOT/SS/.vnmrc file. The log_user_events entry must be set to true.
log_user_events=true
This .vnmrc entry controls whether an event is generated for each user-initiated write to a model attribute value. A value of True causes the VNM to generate events.
The SpectroSERVER will need to be restarted for this change to take effect. Or you can reload the change made in the $SPECROOT/SS/.vnmrc file to put the change in place:
Reload Spectrum VNM .vnmrc resource file using CLI action=0x10700
https://knowledge.broadcom.com/external/article?articleId=190121
NOTE: In most environments, this will generate a considerable number of events, and combined with the normal event processing flow this could affect performance. Enable with caution.
Sample User Events:
User placed a model in hibernation mode:
Event: User user@host modified attribute isNotHibernating (0x12aca) of IP
(Pingable) to FALSE. Success (CsError=0).
Event Type: 0x1010a
User destroyed a Spectrum device model:
Event: A model has been destroyed. The model was sprint of type CiscoNXOS destroyed by user@host.
Event Type: 0x10202
User took a model out of maintenance mode:
Event: GnSNMPDev (name - SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME): The device model has been taken out of Maintenance Mode by user user@host.
Event Type: 0x10223
User changed the IP address on a model:
Event: User user@host modified attribute Network_Address (0x12d7f) of SimDepotID 3748 -- SW_ETDCAPsLACHAPELLE/CAPAARME
Event Type: 0x1010a
User manually cleared an alarm:
Event: User user@host cleared alarm number 171177 with probable cause id 0x1030a for device host.ca.com of type Host_Device.
Event Type: 0x10706 (This, as well as the other user alarm events, are filtered out of the event tab view by default)
Additional Information
How to check the logs once User Events has been enabled: https://knowledge.broadcom.com/external/article?articleId=10255
Feedback
