How to use Excel to Filter PAM Session Logs

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

it is sometimes necessary to open Session Logs in Excel, as viewing Session Logs in PAM is not very easy, when using multiple filters.

Environment

Release : all

Component : PRIVILEGED ACCESS MANAGEMENT

Cause

Filtering Session Logs on PAM is not very flexible.  It is possible to create multiple filters, but there are limitations.  For example, setting one filter to Details = PAM-CMN-2070 and a second Details = Unauthorized would result in the display of only the entries containing both PAM-CMN-2070 and Unauthorized.  If the second filter contained PAM-CMN-2104 nothing is shown, as it is impossible for the entry to contain both error numbers.It

Resolution

Download the unfiltered session logs and open the csv file with Excel.  Clicking Data and then Filter changes each Column header, so that each of those cells contains a pull down arrow.  Click any of those and type the desired text in the Search field.  You can click the same column header again, type the second desired string and check the Added current selection to filter box.  If PAM-CMN-2070 and PAM-CMN-2104 are used only the entries containing those messages will be seen.  It is also possible to easily combine multiple columns, merely by clicking the pull down arrow for another column.  It is also possible to use the other options on the pull down menu, such as Sort or Text Filters.