Run reports on Spectrum User activity events

Document ID : KB000009819
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

Configure Spectrum to log User Activity events, and generate a report.

Background:

Spectrum can be configured to log User Activity events, such as when a user creates a model, destroys a model, places a device into maintenance mode, clears and alarm, and several others. A custom filter can then be created in CABI 4.1 to generate a user audit report using only these events. 

Environment:
Spectrum 10, 10.0, 10.1, 10.1.1, 10.1.2.CABI 4.1 sp3
Instructions:

First enable logging of User Activity events

1.    Locate the .vnmrc file in <SPECROOT>/SS

2.    Find the line log_user_events= and append with “true”

a.    Ex. Log_user_events=true

3.    Save the file and restart the SpectroServer

Next, configure the Events to be stored in the historical database (DDM).

1.    Bring up Event Configuration Utility in OneClick by selecting Tools > Utilities > Event Configuration

2.    Filter for the Event Code

3.    Click on the Event and then the Event Options tab

4.    Ensure “Store Event in historical Database” is checked

5.    Do this for all User Events

The list of User Events is below:

0xaa005 – User reloaded Event files
0x1010a - User modified attribute
0x1010d - User modified attribute
0x10201 - A model has been created
0x10202 - A model has been destroyed
0x10219 - A Model has been unlocked from edit
0x1021a - A Model has been unlocked from edit
0x10220 - A model has been placed in maintenance mode
0x10220 - A model has been taken out of maintenance mode
0x10222 - A device model placed in maintenance
0x10223 – A device model taken out of maintenance
0x10224 – A port model placed into maintenance
0x10225 – A port model taken out of maintenance
0x10226 – A model placed into hibernation mode
0x10227 – A model taken out of hibernation
0x10501 - user message
0x10502 - Notes message updated
0x10250 – An attribute value changed
0x10251 – A model type changed
0x10703 – An alarm has been updated
0x10705 – An alarm has been updated
0x10706 – A User cleared alarm
0x10707 – An alarm has been updated

The next step is to create a filter XML file and add it to the OneClick custom folder

1.    Create a file called User_events.xml and add the following content:

<?xml version="1.0" encoding="UTF-8" ?>

<!-- All events are related to User Events.
-->

<filter xmlns=http://www.aprisma.com
        xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance
        xsi:schemaLocation="http://www.aprisma.com ./event-filter.xsd">

<!-- User reloaded Event files -->
<event_type>0xaa005</event_type>
<!-- User modified attribute -->
<event_type>0x1010a</event_type>
<!-- User modified attribute -->
<event_type>0x1010d</event_type>
<!-- a model has been created -->
<event_type>0x10201</event_type>
<!-- A model has been destroyed -->
<event_type>0x10202</event_type>
<!-- A model has been locked for edit -->
<event_type>0x10219</event_type>
<!-- a Model has been unlocked from edit -->
<event_type>0x1021a</event_type> 
<!-- A model has been placed in mainenance mode -->
<event_type>0x10220</event_type>
<!-- A model has been taken out of maintenance -->
<event_type>0x10221</event_type>
<!-- A device model placed in maintenance -->
<event_type>0x10222</event_type>
<!--Device model taken out of maintenance -->
<event_type>0x10223</event_type>
<!-- Port model placed into maintenance -->
<event_type>0x10224</event_type>
<!-- Port model taken out of maintenance -->
<event_type>0x10225</event_type>
<!-- Model placed into hibernation mode -->
<event_type>0x10226</event_type>
<!-- Model taken out of hibernation -->
<event_type>0x10227</event_type>
<!-- user message -->
<event_type>0x10501</event_type>
<!-- Notes message updated -->
<event_type>0x10502</event_type>
<!-- Attribute value changed -->
<event_type>0x10250</event_type>
<!-- Model type changed -->
<event_type>0x10251</event_type>
<!-- Alarm has been updated -->
<event_type>0x10705</event_type>
<!-- Alarm has been updated -->
<event_type>0x10703</event_type>
<!-- User cleared alarm -->
<event_type>0x10706</event_type>
<!-- Alarm has been updated -->
<event_type>0x10707</event_type>

</filter>

2.    Place the file in <SPECROOT>\tomcat\webapps\spectrum\WEB-INF\repmgr\config

3.    Bounce OneClick Tomcat

SRM will poll the DDM for events every hour. After some time for SRM to poll for the User Events, you can access CABI Launch Pad and run a report on Events > All.*

1.    Once in Launch Pad, go to CA Reports > CA Spectrum > Event > All

2.    Under the option to Include or Exclude, choose Include

3.    Under the Select Event Types to Include, find “User Events”

4.    Edit the Report Title “User Reports”

5.    Specify the data range / time interval for the report

6.    Run Report

 

*Note: If you are running Spectrum 10.1.1, please contact Support and request patch 10.01.01.PTF_10.1.139

Additional Information:

https://support.ca.com/cadocs/0/CA%20Spectrum%209%203%200-ENU/Bookshelf_Files/PDF/Spectrum_Report_Manager_Install_Admin_ENU.pdf