Super Account CMN-0914 ID is showing for Normal User Login

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Super User Login CMN ID is linked to few of the users login which is causing issue. We have set SOX alerts based on these CM ID's for Super user usage, so since same CMN is getting for normal user login we are getting alerts.

 

Could you please help us understand why same CMN ID's are allocated for Super User login and Normal End User login.

Environment

Release : 3.4

Component :

Resolution

All users with the "email on login" switch set in the user account will generate this message, not just super.

PAM-CMN-0914 = User {0} has logged into the CA Privileged Access Manager appliance {1}.

the {0} indicates the username variable 

If you want to monitor only for "super" usage you would filter for "PAM-CMN-0914 = User super" since the message code itself would not be enough  and would show for any user with the alert flag set.