Determine who turned on/off Maintenance Mode in PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A Privileged Access Management (PAM) admin is looking to determine who turned on or off maintenance mode in the PAM UI, on a certain PAM appliance(s).

Environment

PAM 4.1.0 -> 4.1.3

Resolution

In PAM 4.1.0 - 4.1.3 - PAM support would need to be given a logs.bin on the appliance in question, which we can supply the IP address that it originated from.

In PAM 4.1.5 and above, we now log the follow messages in the session logs:

• PAM-CM-0217: Maintenance mode has been enabled for this appliance
• PAM-CM-0218: Maintenance mode has been disabled for this appliance

and the user who did it.