Steps to track changes and activities by client users attached to a Smarts domain using the Smarts Console

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

• How to track all changes made in Smarts from any client such as the Smarts Global Console, dmctl command line, ASL scripting, and so on.
• Steps required for users of EMC Smarts software to enable audit logging for all client actions.
• How to audit Smarts client actions
• Smarts environment needs to have detailed logging for client actions by UserID
  
  

Environment

All supported release of Smarts

Resolution

To enable this functionality, you can configure either of the following parameter settings in the runcmd_env.sh file:

• SM_AUDIT_CLIENT_ACTIONS=1: Setting this parameter to 1 will enable audit logging for the Smarts Console Gui only. All actions initiated from the Smarts Console will be tracked in the <Domain-NAME>_audit.log file in the <SmartsInstallDir>/local/logs/ directory.
• SM_AUDIT_ALL_CONNECTIONS=1: Setting this parameter to 1 will enable audit logging for all Smarts clients (Console, dmctl, asl, java..etc). All actions initiated from the Smarts Console will be tracked in the <Domain-NAME>_audit.log file in then<SmartsInstallDir>/local/logs/ directory.

Steps to add the required setting: 

1. Open the runcmd_env.sh configuration file using sm_edit:

   ./sm_edit conf/runcmd_env.sh

2. Add either of the following lines to the runcmd_env.sh file, depending on your requirements:

SM_AUDIT_CLIENT_ACTIONS=1
SM_AUDIT_ALL_CONNECTIONS=1

3. Restart the Smarts domain to reload the runcmd_env.sh file.
4. Once the domain restarts you will see the following file created:

<Domain-NAME>_audit.log

Audit logging syntax

<Time/Date> <User> <ClientType> <Version> <Client_PID> <Client_IP> <UsernameOnClientMachine> <MachineName> <Operation_Initiated>

Audit logging examples (Smarts console)

• Get Port instances:

<TimeDate> admin IC Console - <Console version> #.#.#.# <UsernameOnClientMachine> My_PC invoke object=DXA_TopologySourceFactory::DXA-TopologySourceFactory oper=getClassSchemaForRelationships args={ Port }

• Set Port to Managed state:

<TimeDate> admin IC Console - <Console version> #.#.#.# <UsernameOnClientMachine> My_PC invoke object=Port::PORT-#.#.#.#/1.4 oper=manage args={ }

• Set Port to Unmanaged state:

<TimeDate> admin IC Console - <Console version> #.#.#.# <UsernameOnClientMachine> My_PC invoke object=Port::PORT-#.#.#.#/1.4 oper=unmanage args={ }

Audit logging examples (ASL)

<TimeDate> admin INCHARGE-SA ASL 23567 #.#.#.# root <MyMachine> invoke object=DXA_TopologySourceFactory::DXA-TopologySourceFactory oper=getTopologyData "args={ VSSChassis, Virtualizes , FALSE }"