The CA PPM UI has been reset on our environment, but we can not track who has done the change
How can I identify who has changed the UI Theme in CA PPM
Any CA PPM release
In order to find out who has changed the UI Theme, here some steps that can be followed:
1. Look at the app-access-YYYY-MM-DD.log file
2. Locate an entry similar to:
|[16/Jun/2017:02:07:05 -0400]|POST /niku/nu?uitk.vxml=1&action=uif.uiThemeList HTTP/1.1|200|16473|109|5123073__AC284558-3192-4D33-B559-41CAE41EAF1E
|[16/Jun/2017:02:07:12 -0400]|POST /niku/nu?uitk.vxml.form=1&action=uif.updateUIThemeAsDefault&uitk.navigation.location=Workspace&uitk.navigation.parent.location=Workspace&uitk.navigation.last.workspace.action=uif.uiThemeList HTTP/1.1|200|80504|31|5123073__AC284558-3192-4D33-B559-41CAE41EAF1E
3. Note the following:
action: This is the action: uif.updateUIThemeAsDefault
session ID: 5123073__AC284558-3192-4D33-B559-41CAE41EAF1E (specifically 5123073)
4. Now, query the DB:
select * from CMN_SESSION_AUDITS where session_id = 5123073
5. The result of the select query will provide you the user_id on the cmn_sec_users table.
6. Querying the cmn_sec_users table against the user_id of the above select, it will give you the details of the user who did the change.
Please note: If UI Theme is changed through a XOG the update may not show in app-access logs. Next step check the app-ca and bg-ca logs.update.