Read Only user incorrectly owns other customer Threshold Profiles in CA Performance Management (CAPM)

Products

• Network Observability
• CA Performance Management

Issue/Introduction

Read Only user incorrectly owns other customer Threshold Profiles in CAPM where they see some Threshold Profiles (TP) that are owned by users that are not part of that tenant and have a created date as 21st January 1970.

Environment

DX NetOps CAPM all currently supported releases

Cause

The REST XML contains an Owner ID setting that is not valid for the user accounts to which the Threshold Profile/s (TPs) are being created and assigned.

The following is an example:

    body: |

      <EventProfile version="2.0.0">

        <OwnerID>53</OwnerID>

        <Enabled>true</Enabled>

        <LastModifiedUserID>53</LastModifiedUserID>

        <LastModifiedTime>{{ ansible_date_time.epoch }}</LastModifiedTime>

        <EventRuleIDList>

          <EventRuleID>{{ threshold_cpu_major_rule_id }}</EventRuleID>

          <EventRuleID>{{ threshold_cpu_critical_rule_id }}</EventRuleID>

        </EventRuleIDList>

        <Item version="1.0.0">

          <Name>{{ threshold_profile_outer_loop_item.name }}_CPU_Profiles</Name>

          <Description/>

        </Item>

      </EventProfile>

 

The OwnerID in the above example of a REST API call body, is set to 53. This means that on every run of this call, the user account will be the one with OwnerID 53.

If this Owner ID is not changed dynamically to associate with correct users, then ALL profiles will be created using the same user and owned by same user, regardless of the tenant the profile is being created in.

Resolution

 

You can check who is OwnerID 53 by querying the netqosportal DB (mysql) on the command line (CLI) in Portal, as per:

1. cd /opt/CA/MySql/bin
   
   
2. Login to the mysql DB using either root or netqos as the user (whichever works):
   
   

   ./mysql -uroot -p<PASSWORD> netqosportal


3. Run:
   
   select userid,name from user_definitions where userid=53;

The above will return the user account being used to create the Threshold Profiles via REST.

You will have to change the OwnerID in their REST API script to a valid user for the particular TP so this problem doesn't occur.