6.5 Auditing Administration Elements

This section describes the audit events available for each administrative element. After you globally enable the audit function, it is necessary to select events to be audited for individual administration elements. This requires opening an element’s properties and selecting audit events on the Audit page. Audit events can be selected for the Administration element and for its child elements.

The following figure shows the available audit events for the Adapters element.

Figure 6-2 Adapter Audit Properties

6.5.1 Selecting Audit Events for an Administration Element

In the Explorer pane, right-click the element and select Properties.
In the left pane, click Audit.

The Audit option is available only if the element has auditable events.

The Audit property page displays a list of events that can occur for the element. See Section 6.5.3, Administrative Audit Events for more information about each type of event.
Perform one of the following steps:
- Click All to select all events.
- Select the check box next to an event to enable auditing for the event.
- Click None to deselect all check boxes on the Audit page.
Click Apply to save your changes. Audit alarms are generated for the selected audit events.

6.5.2 Globally Disabling Auditing and Storage of Audit Events

The global settings displayed at the bottom of the element’s Audit property page are Enable Auditing globally with maximum audit alarms and Enable AuditProfile Globally for Alarms History. Changing these settings on any element’s Audit page affects the entire Operations Center enterprise.

For example, if you deselect the Enable Auditing globally with maximum audit alarms check box, auditing is disabled for all elements and for the entire enterprise. No new audit alarms are generated. Similarly, if you deselect the Enable AuditProfile Globally for Alarms History check box, no additional audit alarms are stored in the Data Warehouse.

6.5.3 Administrative Audit Events

Table 6-2 lists the audit events available for each element. It also defines the condition for issuing an audit alarm for each event.

Table 6-2 Audit Event Options

Element	Event	An Audit alarm is issued when…
Access Control	ACL Update operation performed	Changes are made to an element’s Access Control property page.
Access Control	ACL Delete operation performed	A deletion is made on an element’s Access Control property page.
Adapters	Adapter Create performed	An adapter is created.
Adapters	Adapter Update performed	Adapter property changes are applied to an adapter.
Adapters	Adapter Delete performed	An adapter is deleted.
Adapters	Adapter Start performed	An adapter is started.
Adapters	Adapter Stop performed	An adapter is stopped.
Adapters	Adapter’s XMLEditor Save operation performed	An adapter’s hierarchy XML file is modified and saved by using the Operations Center XMLEditor.
Adapters	Adapter Seedfile was read	The Operations Center server reads an adapter’s seedfile.
Adapters	Adapter script was executed	The Operations Center server executes an adapter script (Script.on.Error, Script.on.Initialized, Script.onStarted, or Script.onStopped).
Adapters	Adapter status changed	The status of an adapter changes (the adapter is started or stopped, a connection was lost, and so on).
Adapters	Adapter MODL HierarchyFile was processed	The Operations Center server processes an adapter’s hierarchy file.
Adapters	Formula Adapter log messages (Adapter messages only)	An adapter-related log message (any level) is generated and sent to the log file. In the Alarms View, the Description column displays the contents of the logged message. Includes adapter and integration messages.
Adapters	Formula Adapter ERROR log messages (Adapter error messages only)	An adapter-related ERROR log message is generated and sent to the log file. To audit only this level of log message, select this check box and deselect the general Formula Adapter log messages check box.
Adapters	Formula Adapter WARN log messages (Adapter warning messages only)	An adapter-related WARN log message is generated and sent to the log file. To audit only this level of log message, select this check box and deselect the general Formula Adapter log messages check box.
Adapters	Formula Adapter INFO log messages (Adapter informational messages only)	An adapter-related INFO log message is generated and sent to the log file. To audit only this level of log message, select this check box and deselect the general Formula Adapter log messages check box.
Administration	Script generated Audit Events	A script executed on the Operations Center server creates an audit event.
Analyses	Analysis Save operation performed	An analysis is created or saved from the Performance Analysis dialog box.
Analyses	Analysis Delete operation performed	An analysis is deleted.
Audit	Audit settings updated for an element	An element’s Audit property page is updated.
Automation	Automation script was executed	The Operations Center server executes a server-side automation script.
Calendars	Calendar Create or Update performed	A calendar is created or its property pages are edited.
Calendars	Calendar Delete performed	A calendar is deleted.
	Calendar item Add performed	A new item such as a time definition is added to a calendar.
Calendars	Calendar item Remove performed	An item is removed from a calendar’s Calendar property page.
Calendars	Calendar item Modify performed	A calendar item is edited.
Console Definitions	Console Create operation performed	A console definition is created.
Console Definitions	Console Update operation performed	Changes to a console definition are applied.
Console Definitions	Console Delete operation performed	A console definition is deleted.
Database Definitions	Database Create operation performed	A database definition is created.
Database Definitions	Database Update operation performed	Changes to a database definition’s properties are applied.
Database Definitions	Database Delete operation performed	A database definition is deleted.
Database Definitions	Database Enable operation performed	A database definition is enabled.
Database Definitions	Database Disable operation performed	A database definition is disabled.
Database Definitions	Database schema initialization performed	A database schema is initialized.
Data Warehouse	Data Warehouse settings update performed	Changes to Data Warehouse properties are applied.
Data Warehouse	Start Data Warehouse operation performed	The Data Warehouse is started.
Data Warehouse	Stop Data Warehouse operation performed	The Data Warehouse is stopped.
Data Warehouse	Clear Data Warehouse backup queue operation performed	The Data Warehouse backup queue is cleared.
Data Warehouse	Service Level Agreement updated	Changes to an SLA definition are applied. Only applicable if BSLM is licensed.
Data Warehouse	Global settings changed	Changes to Data Warehouse global settings are applied.
Groups	Group Create operation performed	A new group is created.
Groups	Group Create operation performed	A new group is created.
Groups	Group Update operation performed	Changes to a group’s properties are applied.
Groups	Group Delete operation performed	A group is deleted.
Jobs	Create Job operation performed	A job is created.
Jobs	Edit Job operation performed	A job’s property pages are updated.
Jobs	Enable Job operation performed	The Enable Job command is selected for a job.
Jobs	Disable Job operation performed	The Disable Job command is selected for a job.
Jobs	Enable All Jobs operation performed	The Enable All Jobs command is selected for the Jobs element.
Jobs	Disable All Jobs operation performed	The Disable All Jobs command is selected for the Jobs element.
Jobs	Delete Job operation performed	The Delete Job command is selected for a job.
Jobs	Run Job operation performed	The Run Job command is selected for a job.
Job	Job execution status	A job has been executed.
Operation Definitions	Operation Create performed	An operation definition is created.
Operation Definitions	Operation Update performed	Changes to an operation definition are applied.
Operation Definitions	Operation Delete performed	An operation definition is deleted.
Operation Definitions	An Operation was performed	An element or alarm operation is performed.
Profiles	Profile Create operation performed	A profile is created.
Profiles	Profile Update operation performed	Changes to a profile are applied.
Profiles	Profile Delete operation performed	A profile is deleted.
Profiles	Profile Start Engine operation performed	The Data Warehouse Engine is started.
Profiles	Profile Stop Engine operation performed	The Data Warehouse Engine is stopped.
Profiles	Profile Start operation performed	A profile is started.
Profiles	Profile Stop operation performed	A profile is stopped.
Profiles	Profile Stop and Purge Queue operation performed	The Stop and Purge Queue command is issued.
Profiles	Performance database queue status update	The Data Warehouse Engine database queue status changed because it is being filled (increasing severity) or emptied (decreasing severity).
Profiles	Expression Create operation performed	A new expression is created.
Profiles	Expression Update operation performed	Changes to an expression are applied.
Profiles	Expression Delete operation performed	An expression is deleted.
Schedules	Schedule Create or Update is performed	The Create Schedule command is selected or a schedule’s Schedule property page is edited.
Schedules	Schedule Delete is performed	A schedule is deleted.
Server	Memory threshold violation messages	Memory usage exceeds thresholds.
Server	Log messages (Any non-Adapter messages)	A server-related log message at any level is generated and sent to the log file. In the Alarms View, the Description column displays the contents of the logged message. Filters out adapter and integration messages. IMPORTANT:Use this option only when absolutely necessary. It can generate a large volume of data and cause problems if the system is logging a large amount of information.
Server	ERROR log messages (Non-Adapter error messages only)	To audit only this level of log message, select this check box and deselect the general Log Messages check box.
Server	WARN log messages (Non-Adapter warning messages only)	To audit only this level of log message, select this check box and deselect the general Log Messages check box.
Server	INFO log messages (Non-Adapter informational messages)	To audit only this level of log message, select this check box and deselect the general Log Messages check box.
Sessions	Login session created	A user logs into Operations Center software.
Sessions	Login session destroyed	A user logs out of Operations Center software.
Sessions	Session callback queue status update	Events in the callback queue request a reply from the client. A flood of events can fill up the queue, and cause the client to hang. Audit events can warn when the callback queue is half full. Add the following to /OperationsCenter_install_path/config/formula.custom.properties to set the maximum number of events that can fill the callback queue before a warning is issued: Server.sessionQueueLength=50000 When the number of events in the callback queue reaches one half of this value, warnings are generated. Audit events can be issued when these warnings are generated.
Time Categories	Time Categories Update performed	The Schedules’ element’s Time Categories property page is updated.
Users	User Create operation performed	A new user is created.
Users	User Update operation performed	Changes to a user’s properties are applied.
Users	User Delete operation performed	A user is deleted.
View Builder Repository	View Builder Import operation performed	The Import command is issued.
View Builder Repository	View Builder Export operation performed	The Export command is issued.
View Builder Repository	View Builder Run operation performed	The Run command is issued for a View Builder element.
View Builder Repository	View Builder’s XMLEditor Save operation performed	A View Builder’s XML file is saved using the Operations Center XML Editor.
View Builder Repository	View Builder Delete operation performed	A View Builder element is deleted.
Web Server	Web Server Start operation performed	The Start Web Server command is selected.
Web Server	Web Server Stop operation performed	The Stop Web Server command is selected.
Web Server	Web Server Restart operation performed	The Restart Web Server command is selected.