Smarts SAM/IP: How to audit Smarts client actions; How to track changes and activities by client users attached to a Smarts domain using the Smarts Console

Products

• VMware Smart Assurance

Issue/Introduction

Symptoms:


This article explains the following:

• How to track all changes made in Smarts from any client such as the Smarts Global Console, dmctl command line, ASL scripting, and so on.
• Steps required for users of EMC Smarts software to enable audit logging for all client actions.

Smarts environment needs to have detailed logging for client actions by UserID

Environment

VMware Smart Assurance - SMARTS

Resolution

To enable this functionality, you can configure either of the following parameter settings in the runcmd_env.sh file:

• SM_AUDIT_CLIENT_ACTIONS=1: Setting this parameter to 1 will enable audit logging for the Smarts Console Gui only. All actions initiated from the Smarts Console will be tracked in the <Domain-NAME>_audit.log file in the <SmartsInstallDir>/local/logs/ directory.
• SM_AUDIT_ALL_CONNECTIONS=1: Setting this parameter to 1 will enable audit logging for all Smarts clients (Console, dmctl, asl, java..etc). All actions initiated from the Smarts Console will be tracked in the <Domain-NAME>_audit.log file in then<SmartsInstallDir>/local/logs/ directory.

Procedure
To add the the required setting, do the following:

1. open the runcmd_env.sh configuration file using sm_edit:

./sm_edit conf/runcmd_env.sh

2. Add either of the following lines to the runcmd_env.sh file, depending on your requirements:

SM_AUDIT_CLIENT_ACTIONS=1
SM_AUDIT_ALL_CONNECTIONS=1

3. Restart the Smarts domain to reload the runcmd_env.sh file.
4. Once the domain restarts you will see the following file created:

<Domain-NAME>_audit.log

Audit logging syntax

<Time/Date> <User> <ClientType> <Version> <Client_PID> <Client_IP> <UsernameOnClientMachine> <MachineName> <Operation_Initiated>

Audit logging examples (Smarts console)
Get Port instances:

<TimeDate> admin IC Console - V9.2.0.0 6364 1.1.1.1 <UsernameOnClientMachine> My_PC invoke object=DXA_TopologySourceFactory::DXA-TopologySourceFactory oper=getClassSchemaForRelationships args={ Port }

Set Port to Managed state:

<TimeDate> admin IC Console - V9.2.0.0 6364 1.1.1.1 <UsernameOnClientMachine> My_PC invoke object=Port::PORT-1.2.2.2/1.4 oper=manage args={ }

Set Port to Unmanaged state:

<TimeDate> admin IC Console - V9.2.0.0 6364 1.1.1.1 <UsernameOnClientMachine> My_PC invoke object=Port::PORT-1.2.2.2/1.4 oper=unmanage args={ }

Audit logging examples (ASL)

<TimeDate> admin INCHARGE-SA ASL 23567 1.3.3.3 root <MyMachine> invoke object=DXA_TopologySourceFactory::DXA-TopologySourceFactory oper=getTopologyData "args={ VSSChassis, Virtualizes , FALSE }"