PIM/PAMSC: enable tracing on Windows

Products

• CA Virtual Privilege Manager
• CA Privileged Identity Management Endpoint (PIM)
• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

How do I, or can I enable tracing on Windows for ControlMinder, Access Control, and Privileged Identity Manager?

 

 

Environment

Privileged Identity Manager: all on Windows endpoint

Privileged Access Manager Server Control: all on Windows endpoint

Resolution

Yes, you can enable tracing on Windows.  This is helpful is the core engine is timing out, or you're experiencing some performance losses.  To enable the full tracer.ini tracing on Windows, shut down PIM (secons -s) and modify the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\AccessControl\Tracer

Set TraceEnabled value from 0 to 1.

 

Modify the tracer.ini file (its location is specified by TraceCfgFile registry entry in same location) with below settings.  You may need to remove the ‘read-only’ attribute in order to modify the file. 

In [CLog Settings]:
Check that the line starting with LogFileDLL points to a valid location. 

In [Trace] section:

Ensure that ‘FileName’ is set to an actual location

Add:
MaxFileSize=200000000
MessageFormat =%D %T (%L) Message: %M\n

The section will read something like:

[Trace]
Output=LogFile
FileName=c:\Trace.log
OpenMode=1 
MaxFileSize=200000000
MessageFormat =%D %T (%L) Message: %M\n
MaxNumberOfHistFiles=2

In [filters], change:
[*.MST_TRACE.*]
To
[*.*.*]

When you start PIM (seosd -start), the debug will begin with the log file created in the 'FileName' location defined in the tracer.ini file.