The CA PPM UI has been reset on our environment, but we can not track who has done the change
How can I identify who has changed the UI Theme in CA PPM
In order to find out who has changed the UI Theme, here some steps that can be followed:
1. Look at the app-access-YYYY-MM-DD.log file
2. Locate an entry similar to:
|[16/Jun/2017:02:07:05 -0400]|POST /niku/nu?uitk.vxml=1&action=uif.uiThemeList HTTP/1.1|200|16473|109|5123073__AC284558-3192-4D33-B559-41CAE41EAF1E
|[16/Jun/2017:02:07:12 -0400]|POST /niku/nu?uitk.vxml.form=1&action=uif.updateUIThemeAsDefault&uitk.navigation.location=Workspace&uitk.navigation.parent.location=Workspace&uitk.navigation.last.workspace.action=uif.uiThemeList HTTP/1.1|200|80504|31|5123073__AC284558-3192-4D33-B559-41CAE41EAF1E
3. Note the following:
action: This is the action: uif.updateUIThemeAsDefault
session ID: 5123073__AC284558-3192-4D33-B559-41CAE41EAF1E (specifically 5123073)
4. Now, query the DB:
select * from CMN_SESSION_AUDITS where session_id = 5123073
5. The result of the select query will provide you the user_id on the cmn_sec_users table.
6. Querying the cmn_sec_users table against the user_id of the above select, it will give you the details of the user who did the change.