Audit user operations in Operator Console

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

I am looking for some help on common SQL queries that could help us retrieve information about what user deployed a certain probe or what user created/deployed a certain MCS profile.  Queries like that could be very helpful for us to track down when something seems off and we need to know more background.

Environment

Release: 20.4
Component: audit probe

Resolution

The following would cover what you need to audit Operator Console actions:

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/unified-infrastructure-management/20-4/administering/UIM-Auditing-in-APIs.html

As described, these are the tables related to it:

select * from WASP_AUDIT_DETAILS
select * from WASP_AUDIT_LOG

If you want to audit IM and AC, than you would need to install the audit probe on the primary and set the sources that you want to audit. This requires a bit more thought of what you really want to audit, as you set auditing at the robot level. You can however set auditing on the primary hub, and you will get records for things that will indicate a probe deployment to another source without actually setting auditing on the downstream robot. If however, you make changes on a given probe on a downstream source, that would require that auditing be turned on for that robot. 

These are the tables that are related to the audit probe:

select * from AUDIT_EVENT
select * from AUDIT_CONFIG_CHANGE

Additional Information

sample: