Operator Console MCS User Interface (UI) Auditing

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

How to configure MCS User Interface Auditing for all MCS UI activities, e.g., profile creation, deletion, edits.

Environment

• DX UIM 23.4 CU4
• OC 23.4 CU4
• wasp 23.4.4

Cause

• MCS UI Auditing guidance

Resolution

Operator Console MCS UI Auditing - Implement MCS user interface level auditing for MCS activity.

Run queries to provide more details of profile activity, e.g., creation, deletion, edits.

1. Enable OC wasp auditing by adding an auditing section in wasp and set the following keys and values:
   
   
   
   
2. Then run the following queries and collect the results with headers:

--List the auditing results such as profiles created, deleted, TEMPLATE_ACTIVATION_SUCCEEDED, etc…

select * from SSRV2AuditTrail where action='DELETED' and objectname like '%<full_or_part_of_profile_name>%';

--List the OC Auditing results when auditing is enabled:

select * from wasp_audit_log order by timestamp desc

For deletes use a where clause, e.g.,

select * from wasp_audit_log where action='DELETED' and objectname like '%full_or_part_of_profile_name%';

–List changes such as edits to group names

select * from wasp_audit_details

Keep in mind that you must collect this audit data before it gets purged based on the configured history value. SUggestion: set days_in_history to more than 1 month.

Additional Information

As always, please include the headers from the query output if you're sharing query results with Support.

Here is an example of the SSRV2Audittrail table showing the mon_config_service activity:

You can check these tables by running the queries but make sure your configuration saves enough data for a longer time period, enough to view older data, e.g., 35 days for the wasp_audit_log by editing the parameter 'days_in_history.'

select * from wasp_audit_log

select * from ssrv2audittrail