User Log inquiry

Document ID : KB000118689
Last Modified Date : 30/10/2018
Show Technical Document Details
Issue:
We are being audited and we are looking for a way to find out if a particular user accessed the system in a specific time frame.
Resolution:
The options are: 

The audit log keeps a history of all *unsuccessful* login attempts: 
https://docops.ca.com/ca-harvest-scm/13-0/en/administrating/administrate-data#AdministrateData-AuditLog 

Will only show failed login attempts: 
SELECT AUDITEVENTOBJID, 
ACTIONOBJID, 
SUCCESSFAILURE, 
ACTIONNAME, 
TO_CHAR(EVENTTIME, 'mm/dd/yyyy hh:mi:ss') EVENTTIME, 
USROBJID, 
USERNAME 
FROM HARAUDITLOGVIEW 
WHERE ACTIONOBJID = 411; 

In the database, the HARUSER table records the last time the user successfully logged in to the system. But this will not show a history of every login attempts by a specific user. 
Will show the last successful login of each user: 
SELECT HARUSER.USROBJID, 
HARUSER.USERNAME, 
TO_CHAR(HARUSER.LASTLOGIN, 'mm/dd/yyyy hh:mi:ss') LASTLOGIN; 
FROM HARUSER 

If the HBroker logs exist for the desired time frame , the other option would be to search the broker log files (<date>HBroker<pid>.log) for entries like this: 

- Default: On User register - 10:48:10 
From : /pt_HClient://scm-broker/2492 
User : harvest 

Any attempt to login will have an entry like this in the broker log files. 

If you're looking for a specific type of activity, the audit logs record certain things like create/update project, state, user, packate, etc. 

We can also search the various main tables for any records last updated by the desired user. All the main tables like HARPACKAGE, HARENVIRONMENT, HARSTATE, HARVERSION, etc have these fields: 

CREATIONTIME 
CREATORID 
MODIFIEDTIME 
MODIFIERID 

But, again, it only shows the last update, not a history of all updates.