How does PIM Endpoint resolves IP to hostname in audit log?

Products

• CA Privileged Identity Management Endpoint (PIM)
• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

Sometimes when we run seaudit there are IPs that are not resolved to the hostnames and hostnames that can't be resolves to IP's

How does PAMSC Endpoint resolves IP to hostname in audit log?

Environment

Release : 14.1.x

Component : CA Privileged Access Manager Server Control - Endpoint

Resolution

There are 2 use cases how PAMSC resolves IP to hostname. (This is applicable for *UNIX environments only)

 1. When PIM checks the rule
 2. When user runs seaudit command

At the first use case, IP addresses are resolved to hostname by utilizing LADB (lookaside database) and also system call if osuser_enabled=yes is set in seos.ini. Please refer below documentation for more about lookaside database.

sebuildla Utility Create a Lookaside Database

At the 2nd use case, PAMSC Endpoint will resolve using system call. So, when system cannot resolve the IP address, seaudit command may show IP address only.