HP Operations Manager

Message change audit event attributes


The Event Properties dialog displays message change audit attributes, as shown below:

The table explains the message change audit event attributes:

Attribute Description
Type Is always "Success Audit."
Date, Time Contains the date/time when the auditing event was logged. Due to race conditions, this may not be exactly the time when the message change was done in the local HPOM for Windows database; for forwarded message changes this may not be the time when the message change was originally made to the message on the sending server.
Source Is "MessageChanges_local" or "MessageChanges_forwarded," depending on where the original message change was done. If changed locally, the source is "MessageChanges_local." If the message change was received from another management server, the source is "MessageChanges_forwarded."
Category Can be one of the following, depending on the message change that was audited:
  • Custom Message Attributes Change
  • Severity Change
  • State Change
  • Text Change
  • Annotation Add
  • Annotation Delete
  • Annotation Modify
  • DBMaint execution (for English locale)

The Category name is locale dependent and localized to Japanese, Korean, and Simplified Chinese.
Event The identifier for the type of message change that was audited:
  • custom message attribute change, event = 711
  • message severity change, event = 712
  • message state change, event = 713
  • message text change, event = 714
  • message annotation add, event = 715
  • message annotation delete, event = 716
  • message annotation modified, event = 717
  • DB Maintenance message download and deletion, event = 718
  • DB Maintenance message deletion, event = 719
User For local message changes, this is the local user who made the change. For forwarded message changes, this is the user account of the service that logged the auditing event; in most cases this will be the LOCAL SYSTEM account.
Computer Always the host name of the local HPOM for Windows server.
Description Depends on the type of message change that was audited, as described below:
  • For a custom message attribute change, the description is:

    (MS711) The custom message attributes were changed on $(MsgSeverity) message "$(MsgId)" to $(NewListOfCMAs) by user "$(UserName)" at $(DateTime).

  • For a message severity change, the description is:

    (MS712) The message severity was changed on message "$(MsgId)" from "$(OldSeverity)" to "$(NewSeverity)" by user "$(UserName)" at $(u).

  • For a message state change, the description is:

    (MS713) The message state was changed on $(MsgSeverity) message "$(MsgId)" from "$(OldState)" to "$(NewState)" by user "$(UserName)" at $(DateTime).

  • For a message text change, the description is:

    (MS714) The message text was changed on message "$(MsgId)" from "$(OldText)" to "$(NewText)" by user "$(UserName)" at $(DateTime).

  • For a message annotation add, the description is:

    (MS715) A message annotation was added to message "$(MsgId)" with the annotation text "$(NewAnnoText)" by user "$(UserName)" at $(DateTime).

  • For a message annotation delete, the description is:

    (MS716) A message annotation was deleted from message "$(MsgId)" with the annotation text "$(OldAnnoText)" by user "$(UserName)" at $(DateTime)

  • For a message annotation modified, the description is:

    (MS717) A message annotation was modified on message "$(MsgId)" from annotation text "$(OldAnnoText)" to "$(NewAnnoText)" by user "$(UserName)" at $(DateTime).

  • For DB Maintenance message download and deletion, the description is:

    (MS718) DBMaint execution has downloaded $(NumberOfMessages) messages that have been acknowledged earlier than $(DateTime) to file "$(Path/FileName)." After the download, these messages have been deleted from the database.

  • For DB Maintenance message deletion, the description is:

    (MS719) DBMaint execution has deleted $(NumberOfMessages) messages from the database that have been acknowledged earlier than $(DateTime).

Localization Information

The Description string is locale dependent and localized to Japanese, Korean, and Simplified Chinese, as follows:

$(DateTime) will be replaced by the date/time when the message change was done in the database on the local HPOM for Windows server. For forwarded message changes, this may not be the time when the message change was originally done to the message on the sending server.

$(DateTime) will be localized to the regional and language options of the HPOM for Windows server system (system settings, not the user settings, as done in the console).

For example, a system locale of English (United States) will look like this: 8/30/2005 7:43:49 PM +0200 UTC. This also indicates that the time is regionalized to central European daylight savings time (UTC+2).

$(UserName) will be replaced by the user logon name, followed by the display name, as configured in the user configuration on the domain server, for example, "HPOMTest\Administrator (John Doe, HP USA)." The display name is only provided in $(UserName) if it can be resolved by asking the Domain server. To be able to resolve this name, the HPOM for Windows server must be a domain member of the user's domain. In the example above, the HPOM for Windows server must be member of the HPOMTEST domain to be able to resolve the user's display name.

Note NOTE:
The lookup of the display name is very expensive. For performance reasons this lookup is only done once and the lookup result is stored in a memory cache. A change of a user's display name on the domain server will not become visible in the HPOM for Windows message change auditing until the WMI service is restarted with the following command:

net stop winmgmt; net start winmgmt