The CA PPM UI Theme has been changed and would like to know who changed it.

Document ID : KB000014955
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

The CA PPM UI has been reset on our environment, but we can not track who has done the change

Question:

How can I identify who has changed the UI Theme in CA PPM

Environment:
Any CA PPM release
Answer:

In order to find out who has changed the UI Theme, here some steps that can be followed:

1. Look at the app-access-YYYY-MM-DD.log file

2. Locate an entry similar to:

|[16/Jun/2017:02:07:05 -0400]|POST /niku/nu?uitk.vxml=1&action=uif.uiThemeList HTTP/1.1|200|16473|109|5123073__AC284558-3192-4D33-B559-41CAE41EAF1E
|[16/Jun/2017:02:07:12 -0400]|POST /niku/nu?uitk.vxml.form=1&action=uif.updateUIThemeAsDefault&uitk.navigation.location=Workspace&uitk.navigation.parent.location=Workspace&uitk.navigation.last.workspace.action=uif.uiThemeList HTTP/1.1|200|80504|31|5123073__AC284558-3192-4D33-B559-41CAE41EAF1E

3. Note the following:
   action: This is the action: uif.updateUIThemeAsDefault
   session ID: 5123073__AC284558-3192-4D33-B559-41CAE41EAF1E (specifically 5123073)
4. Now, query the DB:
   select * from CMN_SESSION_AUDITS where session_id = 5123073
5. The result of the select query will provide you the user_id on the cmn_sec_users table.
6. Querying the cmn_sec_users table against the user_id of the above select, it will give you the details of the user who did the change.