Is deletion of computer action logged somewhere ?

Products

• CA Client Automation - IT Client Manager
• CA Client Automation

Issue/Introduction

Someone has deleted a computer in DSM Explorer, is it possible to know who and when ?

Environment

Client Automation - All Versions

Resolution

By default, Domain Manager sends the event to Windows Event Viewer Application.

 

Event like this is logged :

 

Source = DSM

Event ID = 1000

Task Category = DSM

Level = Information

Computer deleted by user winnt://<computername>/<username>: name=<deleted_computername>, classid=1, uuid=<deleted_computer_uuid>

 

 

But if needed it is also possible to log this action into a file.

 

1- Unseal the configuration policy applied on the Domain Manager and set

DSM/Common Components/Event Logging/Event Log: File Destination = 10

10 means events sent to OS and File :

"Event log destination. 1=Default, 2=OS log, 4=Unicenter log, 8=File log. You can specify multiple destinations by adding flags together. e.g. to specify the OS and Unicenter logs, you would specify a value of 6."

 

 

size of log files could also be increased to 1000 Kb :

DSM/Common Components/Event Logging/Event Log: Maximum size of log files = 1000

 

2- Seal the policy.

Once it is applied on the Domain Manager restart caf :

caf stop

caf start

 

 

3- Now events are sent to Windows Event viewer Application and file C:\Program Files (x86)\CA\DSM\logs\EVENTS_*.log