Administer > Setup and Maintenance > Audit Log

Audit Log

You use the audit log to keep track of different actions performed by OMi users, according to specific contexts.

ClosedTo access

Administration > Setup and Maintenance > Audit Log

Alternatively, click Audit Log.

Learn More

ClosedOperations Management Audit Log

Auditing the changes to configurations of Operations Management, changes to events, and execution of tools and actions is critical to reducing security risk and achieving compliance.

You can configure OMi to generate and record audit events when a user changes an Operations Management configuration or an event. For example, if a user executes an action on a node, a corresponding entry is made in the Operations Management Audit Log, recording the date and time of execution, the user who started the action, and a description of the action run.

There are two audit categories to configure which type of changes are logged:

  • Configuration. The default value is Configuration. When you set this category, only configuration changes are written to the Audit Log. For details, see Operations Management Configuration Changes.

  • All. When you set this category, both event and configuration changes are written to the Audit Log.

Tasks

ClosedHow to View Audit Information

  1. Select a context in the Audit Log manager.

  2. Optional. Click the Auditing Filters link to specify filter criteria. The following filters are available:

    • User. Specifies user associated with the audit information that you want to view.

    • Containing text. Specifies the text string that you want to search for.

    • Start after: Specifies the start time for the time period for which you want to search the audit log.

    • End before: Specifies the end time for the time period for which you want to search the audit log.

  3. Click Apply. The filtered results are displayed.

If required, use the Next Page or Previous Page arrows to navigate to the next or previous page of the Audit Log.

ClosedHow to Configure Operations Management Auditing

  1. Open the Infrastructure Settings manager:

    Administration > Setup and Maintenance > Infrastructure Settings

    Alternatively, click Infrastructure Settings.

  2. In the Applications list, set the context to Operations Management.

  3. In the Operations Management - Auditing Settings section, click Edit Setting for the Audit Category entry.

  4. In the Edit Setting dialog box, select the auditing level:

    • Configuration: Record only changes made to Operations Management configurations. This is the default setting.

    • All: Records all changes to Operations Management configurations and events.

  5. Click Save.

  6. In the Operations Management - Auditing Settings section, make sure the Enable Auditing entry is set to true. Auditing is enabled immediately after saving the configuration.

ClosedHow to Customize Audit Log File

The Audit Log uses the Apache log4j logging utility.

To customize the log file, edit the log4j configuration file:

<OMi_HOME>/conf/core/Tools/log4j/jboss/auditlog.properties

Set the log level to INFO or higher.

Note Do not change the appender name:

com.mercury.topaz.tmc.bizobjects.audit.AuditManager.writeAudit

Reference

ClosedAudit Log Contexts
Audit Log Context Description
CI Status Alert Administration Displays actions related to creating alert schemes for a configuration item (CI) status alert.
Downtime/Event Scheduling Displays actions related to creating and modifying downtime and scheduled events.
Infrastructure Settings Displays actions related to modifying infrastructure settings. The result of each action is denoted as SUCCESS or FAILURE.
Login Displays actions related to users' logins and logouts. The result of each action is denoted as SUCCESS or FAILURE.
Notification Template Administration Displays actions related to modifying open ticket information, ticket settings, closed tickets, ticket templates, and subscription information: notification types (locations or general messages), and recipients.
Operations Management Displays actions related to Operations Management, such as the creating and modifying of content packs, event rules, and notifications.
Recipient Administration Displays actions related to modifying information about the recipients of audit logs.
Service Health Displays actions related to the Service Health application.
Service Health Administration Displays actions related to configurations made in Service Health Administration.
Startup/Shutdown Displays actions related to startups and shutdowns of OMi host systems.
User/Group Management Displays actions related to adding, modifying, and deleting users, user groups, and roles. Additionally, it displays the assignments of permissions to roles and the assignments of roles to users and user groups.
View Manager Displays actions related to KPIs such as adding a KPI, editing a KPI, and deleting a KPI. Additionally, it displays actions related to changing the Save KPI over time data option.
ClosedOperations Management Event Changes in the User Interface

The following is a list of the event changes that are audited. For event-related changes to be recorded, the Audit Category must be set to All.

When a change is made, only the new value is written to the Audit log.

Event Change Action
Action Launch
Custom attributes Create, edit, and delete
Annotations Create, edit, and delete
Assign event to user or group Change
Event title Edit
Forwarding actions Launch
Lifecycle state of event Change
opr-archive-events.bat, opr-close-events.bat Launch
Priority of event Change
Automatic or operator action Rerun
Severity of event Change
Tool Launch
ClosedOperations Management Configuration Changes

The following is a list of the configuration changes that are audited. For configuration-related changes to be recorded, the Audit Category can be set to Configuration or All.

Configuration Change Action
Audit Configuration Change, enable, and disable
CI Resolver Mapping Create, edit, and delete
Connected Server Create, edit, and delete
Content Packs Create, edit, delete, import, and export
Custom Action Configurations Create, edit, and delete
Downtime Configuration Create, edit, and delete
EPI Configuration Create, edit, and delete
Event Assignment Rules Create, edit, and delete
Event Forwarding Web service-triggered actions using the console API
Filters

Create, edit, and delete

Only changes about filters created and used in the Operations Management Admin user interface, for example, Indicator Mapping Rules, User Group Assignment, Forwarding Rules are written to the Audit log. Filters defined by operators in the Operations Management Application user interface are not audited.
Forwarding Rules Create, edit, and delete
Indicator Mapping Rules Create, edit, and delete

Monitoring Automation: Aspect Versions

Create and delete

Monitoring Automation: Assignments

Create, delete, and change

Changes include disabling and enabling assignments, and changing parameter values.
Monitoring Automation: Automatic Assignments

Create and delete

Monitoring Automation: Configuration Folders Create, delete, and change deployment

Monitoring Automation: Deployment Packages

Create and delete

Monitoring Automation: Instrumentations

 Create, delete, and change

Monitoring Automation: Jobs

 Create, delete, and change

Monitoring Automation: Management Template Versions

 Create and delete

Monitoring Automation: Node Groups

Create, delete, and change.

Changes including adding a node to and removing a node from a node groups.

Monitoring Automation: Node Filters

Create, delete, and change

Monitoring Automation: Nodes

Create, delete, and change

Monitoring Automation: Template Groups

Create, delete, and change.

Changes include adding a template to or removing a template from a template group.

Monitoring Automation: Template Types

Create and delete

Monitoring Automation: Template Versions

Create and delete
TBEC Rules Create, edit, and delete
Tools for CI Type Create, edit, and delete
View Mapping for CI Type Create, edit, and delete
ClosedOperations Management Areas Not Audited

The Operations Management areas that are not audited are listed in the following list.

  • Changes to displayed columns in the Event Browser

  • Change to column sizes

  • Information about which column was used for ordering

  • Active filter applied

ClosedUser/Group Management Configuration Changes
Configuration Change Action
Permissions

Create, edit, and delete

Assign to a role

Remove from a role
Role

Create, edit, and delete

Assign to a user group

Remove from a user group
User

Create, edit, and delete

Assign to a user group or a role

Remove from a user group or a role
User Group

Create, edit, and delete

Assign to another user group

Remove from another user group

Send Help Center feedback